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Introduction 


This Microsoft @ Macro Assembler Reference lists all MASM instructions, 
directives, statements, and operators. It also serves as a quick reference to the 
Programmer’s WorkBench commands, and the commands for Microsoft utilities 
such as LINK and LIB. This book documents features of MASM version 6.1, and 
is part of a complete MASM documentation set. Other titles in the set are: 


Getting Started—Explains how to perform all the tasks necessary to install and 
begin running MASM 6.1 on your system. 


Environment and Tools—Describes the development tools that are included with 
MASM 6.1: the Programmer’s WorkBench, CodeView debugger, LINK, 
EXEHDR, NMAKE, LIB, and other tools and utilities. A detailed tutorial on the 
Programmer’s WorkBench teaches the basics of creating and debugging MASM 
code in this full-featured programming environment. A complete list of utilities and 
error messages generated by ML is also included. 


Programmer’ s Guide —Provides information for experienced assembly-language 
programmers on the features of the MASM 6.1 language. The appendixes cover the 
differences between MASM 5.1, MASM 6.0, and MASM 6.1, and the Backus- 
Naur Form for grammar notation to use in determining the syntax for any MASM 
language component. 


X Reference 


Document Conventions 


The following document conventions are used throughout this book: 


Example 
SAMPLE 2ASM 


Description 


Uppercase letters indicate filenames, segment names, 


KEY TERMS 


placeholders 


Examples 


[optional items] 
{choicel | choice2} 


Repeating elements... 


SHIFT+F1 


registers and terms used at the command line. 


Bold type indicates text that must be typed exactly as shown. 
This includes assembly-language instructions, directives, 
symbols, operators, and keywords in other languages. 


Italics indicate variable information supplied by the user. 


This typeface indicates example programs, user input, and 
screen output. 


Double brackets indicate that the enclosed item is optional. 


Braces and a vertical bar indicate a choice between two or 
more items. You must choose one of the items unless double 
square brackets surround the braces. 


Three dots following an item indicate that you may type more 
items having the same form. 


Small capital letters indicate key names. 


CHAPTER 1. 


Tools 
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2 Reference 


Microsoft. CodeView. Debugger 


The Microsoft CodeViewe debugger runs the assembled or compiled program 
while simultaneously displaying the program source code, program variables, 
memory locations, processor registers, and other pertinent information. 


Syntax 


Options 


Environment 
Variables 


CV [loptions] executablefile [[arguments]] 


CVW [loptions]] executablefile [arguments] 


Option 
/2 
/8 


/25 

/43 

/50 

/B 
/Ccommands 
/F 


/G 
/YO1 1] 


/Ldlifile 
/K 


/M 
/NIO1 1] 


/R 
iS 


/TSF 


Variable 


HELPFILES 
INIT 


Action 


Permits the use of two monitors. 


Uses 8514/a as Windows display, and VGA as debugger 
display (CVW only). 


Starts in 25-line mode. 
Starts in 43-line mode. 
Starts in 50-line mode. 
Starts in black-and-white mode. 
Executes commands on startup. 


Exchanges screens by flipping between video pages (CV 
only). 


Eliminates refresh snow on CGA monitors. 


Turns nonmaskable-interrupt and 8259-interrupt trapping 
on (/11) or off (/10). 


Loads DLL dllfile for debugging (CVW only). 


Disables installation of keyboard monitors for the 
program being debugged (CV only). 


Disables CodeView use of the mouse. Use this option 
when debugging an application that supports the mouse. 


/NO tells CodeView to trap nonmaskable interrupts; /N1 
tells it not to trap. . 


Enables 80386/486 debug registers (CV only). 


Exchanges screens by changing buffers (primarily for use 
with graphics programs) (CV only). 


Toggles TOOLS.INI entry to read/not read the 
CURRENT.STS file. 
Description 


Specifies path of help files or list of help filenames. 
Specifies path for TOOLS.INI and CURRENT.STS files. 


CVPACK 


Syntax 
Options 


EXEHDR 


Syntax 
Options 


CVPACK 3 


The CVPACK utility reduces the size of an executable file that contains 
CodeView debugging information. 


CVPACK [options] exefile 


Option 
/HELP 
/P 
/? 


Action 
Calls QuickHelp for help on CVPACK. 
Packs the file to the smallest possible size. 


Displays a summary of CVPACK command-line syntax. 


The EXEHDR utility displays and modifies the contents of an executable-file 


header. 


EXEHDR [options] filenames 


Option 
/HEA:number 


/HEL 
/MA:number 
/MI:number 


/NE 
/NO 


/PM:type 


/R 


/S:number 


Action 


Option name: /HEA|[[P]]. Sets the heap allocation field to 
number bytes for segmented-executable files. 

Option name: /HEL[[P]]. Calls QuickHelp for help on 
EXEHDR. 


Option name: /MA[X]]. Sets the maximum memory 
allocation to number paragraphs for DOS executable files. 


Option name: /MI[[N]]. Sets the minimum memory 
allocation to number paragraphs for DOS executable files. 


Option name: /NE[[WFILES]]. Enables support for HPFS. 
Option name: /NO][LOGOJ. Suppresses the EXEHDR 
copyright message. 


Option name: /PM[[TYPE]]. Sets the application type for 
Microsoft Windows®, where type is one of the following: 
PM (or WINDOWAPD, VIO (or WINDOWCOMPAT), 
or NOVIO (or NOTWINDOWCOMPAT). 


Option name: /RJESETERROR]. Clears the error bit in 
the header of a Windows executable file. 


Option name: /S[TACK]]. Sets the stack allocation to 
number bytes. 


4 EXP 


Option Action 


/V. Option name: /V[[ERBOSE]]. Provides more information 
about segmented-executable files, including the default 
flags in the segment table, all run-time relocations, and 
additional fields from the header. 

/? Option name: /?. Displays a summary of EXEHDR 

command-line syntax. 


EXP 


- 


The EXP utility deletes all files in the hidden DELETED subdirectory of the 
current or specified directory. EXP is used with RM and UNDEL to manage 


backup files. 
Syntax — EXP [options] [directories] 
Options Option Action 
/HELP Calls QuickHelp for help on EXP. 
/Q Suppresses display of deleted files. 
/R Recurses into subdirectories of the current or specified 
directory. 
/? Displays a summary of EXP command-line syntax. 


HELPMAKE 


The HELPMAKE utility creates help files and customizes the help files supplied 
with Microsoft language products. 


Syntax HELPMAKE {/E][[n]] | /D[[c]] |/H1!/?} options] sourcefiles 
Options Option Action | 
/Ac Specifies c as an application-specific control character for 


_ the help database, marking a line that contains special 
information for internal use by the application. 


IC Indicates that the context strings are case sensitive so that 
at run time all searches for help topics are case sensitive. 


/D Fully decodes the help database. 


Option 
/DS 


/DU 


/E[n] 


/HIELP] 


/Kfilename 


/L 


/NOLOGO 
/Ooutfile 


/Sn 


/T 


/VInl 


/Wwidth 


fe 
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Action 


Splits the concatenated, compressed help database into its 
components, using their original names. No decompression 
occurs. 


Decompresses the database and removes all screen 
formatting and cross-references. 


Creates (“encodes”) a help database from a specified text 
file (or files). The optional ” indicates the amount of 
compression to take place. The value of » can range from 0 
to 15. 


Calls the QuickHelp utility. If HELPMAKE cannot find 
QuickHelp or the help file, it displays a summary of 
HELPMAKE command-line syntax. 


Specifies a file containing word-separator characters. This 
file must contain a single line of characters that separate 
words. ASCII characters from 0 to 32 (including the space) 
and character 127 are always separators. If the /K option is 
not specified, the following characters are also considered 
separators: !"#&’()*+-,/:;<=>?@N4_ {\j~ 


Locks the generated file so that it cannot be decoded by 
HELPMAKE at a later time. 


Suppresses the HELPMAKE copyright message. 


Specifies outfile as the name of the help database. The 
name ouffile is optional with the /D option. 


Specifies the type of input file, according to the following 
values for n: 


/S1 Rich Text Format 
/S2 QuickHelp Format 
/S3 Minimally Formatted ASCII 


During encoding, translates dot commands to application- 


‘specific commands. During decoding, translates 


application commands to dot commands. The /T option 
forces /A:. 


Sets the verbosity of the diagnostic and informational 
output, depending on the value of n. The value of n can 
range from 0 to 6. 


Sets the fixed width of the resulting help text in number of 
characters. The value of width can range from 11 to 255. 


Displays a summary of HELPMAKE command-line 
syntax. 


6 H2INC 


H2INC 


Syntax 
Options 


Environment 
Variables 


The H2INC utility converts C header (.H) files into MASM-compatible include 
(.INC) files. It translates declarations and prototypes, but does not translate code. 


H2INC [options] filename.H 


Option* 
IC 
/Fal[filename]| 


/Fel[filename] 


_/SELP 


/Ht 
/Mn 
/Ni 


/Zn string 


/Zu 
/? 


Action 
Passes comments in the .H file to the .INC file. 


Specifies that the output file contain only equivalent 
MASM statements. This is the default. 


Specifies that the output file contain equivalent MASM 
statements plus original C statements converted to 
comment lines. 


Calls QuickHelp for help on H2INC. 


Enables generation of text equates. By default, text items 
are not translated. 


Instructs H2INC to explicitly declare the distances for all 
pointers and functions. 


Suppresses the expansion of nested include files. 


Adds string to all names generated by H2INC. Used to 
eliminate name conflicts with other H2INC-generated 
include files. © 


Makes all structure and union tag names unique. 


Displays a summary of H2INC command-line syntax. 


*H2INC also supports the following options from Microsoft C, version 6.0 and higher: /AC, /AH, 
/AL, /AM, /AS, /AT, /D, /F, /Fi, /GO, /G1, /G2, /G3, /G4, /Gc, /Gd, /Gr, /I, /J, /Tc, /U, /u, /W0, 
/W1,/W2,/W3, /W4, /X, /Za, /Zc, /Ze, /Zp1, /Zp2, /Zp4. 


Variable 


CL 


H2INC 


INCLUDE 


Description 


Specifies default command-line options. 


Specifies default command-line options. Appended after 
the CL environment variable. 


Specifies search path for include files. 


IMPLIB 


Syntax 
Options 


LIB 


Syntax 
Options 
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The IMPLIB utility creates import libraries used by LINK to link dynamic-link 


libraries with applications. 


IMPLIB [loptions]] implibname {dllfile... | deffile...} 


Option 
/H 


/NOI 
/NOL 


/? 


Action 
Option name: /H[[ELP]]. Calls QuickHelp for help on 
IMPLIB. 


Option name: /NOI[GNORECASE]]. Preserves case for 
entry names in DLLs. 


Option name: /NOL[.OGO]]. Suppresses the IMPLIB 
copyright message. 


Option name: /?. Displays a summary of IMPLIB 
command-line syntax. 


The LIB utility helps create, organize, and maintain run-time libraries. 


LIB inlibrary [Loptions]] [commands] {, [listfile] [[, [outlibrary] ]| 1 Us] 


Option 
/H 
/I 


/NOE 


/NOI 


/NOL 


Action 
Option name: /H[[ELP]]. Calls QuickHelp for help on LIB. 


Option name: /I[GNORECASE]]. Tells LIB to ignore case 
when comparing symbols (the default). Use to combine a 
library marked /NOI with an unmarked library to create a 
new Case-insensitive library. 


Option name: NOE[XTDICTIONARY]]. Prevents LIB 
from creating an extended dictionary. 


Option name: /NOI[GNORECASE]. Tells LIB to 
preserve case when comparing symbols. When combining 
libraries, if any library is marked /NOI, the output library 
is case sensitive, unless /IGN is specified. 


Option name: /NOL[[OGO]]. Suppresses the LIB copyright 
message. 


8 LINK 


Commands 


LINK 


Syntax 
Options 


Option Action 


/P:number Option name: /P[_AGESIZE]]. Specifies the page size (in 
bytes) of a new library or changes the page size of an 
existing library. The default for a new library is 16. 


/? Option name: /?. Displays a summary of LIB command- 
line syntax. 


Operator Action 

+name Appends an object file or library file. 

—name Deletes a module. 

—tname Replaces a module by deleting it and appending an object 
file with the same name. . 

*name Copies a module to a new object file. 

—*name Moves a module out of the library by copying it to a new 


object file and then deleting it. 


The LINK utility combines object files into a single executable file or dynamic- 
link library. 


LINK objfiles [[, [exefile]| (, [mapfile]] {[, [libraries] [[, Ideffile] 1100 Os] 
Option ' Action 


/A:size Option name: /A[LIGNMENT]. Directs LINK to align 


segment data in a segmented-executable file along the 
boundaries specified by size bytes, where size must be a 
power of two. 


/B Option name: /B[.AATCH]]. Suppresses prompts for library 
or object files not found. 
/CO Option name: /CO[DEVIEW]]. Adds symbolic data and 


line numbers needed by the Microsoft CodeView. 
debugger. This option is incompatible with the 


/EXEPACK option. 

/CP:number Option name: /CP[ ARMAXALLOC]]. Sets the program’s 
maximum memory allocation to number of 16-byte 
paragraphs. 

/DO ) Option name: /DO[SSEG]. Orders segments in the default 


order used by Microsoft high-level languages. 


Option 
/DS 


/E 


/F 


/HE 

/HI 

/INC 

/INF 

/LI 

/M 
/NOD|:libraryname] 
/NOE 


/NOF 
/NOI 


/NOL 
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Action 


Option name: /DSJ ALLOCATE]. Directs LINK to load 
all data starting at the high end of the data segment. The 
/DSALLOC option is for assembly-language programs 
that create MS-DOS .EXE files. 


Option name: /E[_XEPACK]]. Packs the executable file. 
The /EXEPACK option is incompatible with /INCR and 
/CO. Do not use /EXEPACK on a Windows-based 
application. 

Option name: /F[ARCALLTRANSLATION]. Optimizes 
far calls. The /FARCALL option is automatically on when 
using /TINY. The /PACKC option is not recommended 
with /FARCALL when linking a Windows-based 
program. 

Option name: /HE[[LP]]. Calls QuickHelp for help on 
LINK. 

Option name: /HI[[GH]]. Places the executable file as high 
in memory as possible. Use /HIGH with the /DSALLOC 
option. This option is for assembly-language programs that 
create MS-DOS .EXE files. 

Option name: /INCJ[REMENTAL]. Prepares for 
incremental linking with ILINK. This option is 
incompatible with /EXEPACK and /TINY. 

Option name: /INF[ORMATION]]. Displays to the 
standard output the phase of linking and names of object 
files being linked. | 
Option name: /LI[|NENUMBERS]]. Adds source file line 
numbers and associated addresses to the map file. The 
object file must be created with line numbers. This option 
creates a map file even if mapfile is not specified. 

Option name: /M[[AP]]. Adds public symbols to the map 
file. 

Option name: /NOD[EFAULTLIBRARYSEARCH]. 
Ignores the specified default library. Specify without 
libraryname to ignore all default libraries. 

Option name: /NOE[XTDICTIONARY]]. Prevents LINK 
from searching extended dictionaries in libraries. Use 
/NOE when redefinition of a symbol causes error L2044. 
Option name: /N OF[ARCALLTRANSLATION]. Turns 
off far-call optimization. 

Option name: /NOI[GNORECASE]. Preserves case in 
identifiers. 

Option name: /NOL[OGO]. Suppresses the LINK 
copyright message. 


10 LINK 


Environment 
Variables 


Option 


~ (NON 


/NOP 


/PACKC][: number] 


/PACKD][:number] 


/PAU 


/PM:type 


/ST:number 


/T 


/? 


Action 


Option name: /NON[ULLSDOSSEGJ. Orders segments 
as with the /DOSSEG option, but with no additional bytes 
at the beginning of the TEXT segment (if defined). This 
option overrides /DOSSEG. 


Option name: /NOP[ACKCODE]. Turns off code 
segment packing. 

Option name: /PACKC[[ODE]]. Packs neighboring code 
segments together. Specify number bytes to set the 
maximum size for physical segments formed by /PACKC. 


Option name: /PACKD[JATAJ. Packs neighboring data 
segments together. Specify number bytes to set the 
maximum size for physical segments formed by /PACKD. 
This option is for Windows only. 


Option name: /PAU[[SE]. Pauses during the link session 
for disk changes. 


Option name: /PM[[TYPE]]. Specifies the type of 
Windows-based application where type is one 

of the following: PM (or WINDOWAPID), VIO 
(or WINDOWCOMPAT), or NOVIO 

(or NOTWINDOWCOMPAT),. 


Option name: /ST[ACK]]. Sets the stack size to number 
bytes, from 1 byte to 64K. 


Option name: /T[INY]]. Creates a tiny-model MS-DOS 
program with a .COM extension instead of .EXE. 
Incompatible with /INCR. 


Option name: /?. Displays a summary of LINK command- 
line syntax. 


Note Several rarely used options not listed here are described in Help. 


Variable 
INIT 
LIB 
LINK 
TMP 


Description 

Specifies path for the TOOLS.INI file. 
Specifies search path for library files. 
Specifies default command-line options. 
Specifies path for the VM.TMP file. 


MASM 


Syntax 


Options 
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The MASM program converts command-line options from MASM style to ML 
style, adds options to maximize compatibility, and calls ML.EXE. 


Note MASM.EXE is provided to maintain compatibility with old makefiles. For 
new makefiles, use the more powerful ML driver. 


MASM [options] sourcefile [[, [objectfile] [[, [Jistingfile]] 
I, [[crossreferencefile] ] 1 1 I] 


Option 
/A 


/B 

IC 

/D 
/Dsymbol{[=value]| 
/E 

/H 

/HELP 

/I pathname 
/L 

/LA 

/ML 

/MU 

/MX 

/N 

/P 


IS 


/T 
/V 


Action 


Orders segments alphabetically. Results in a warning. 
Ignored. 


Sets internal buffer size. Ignored. 

Creates a cross-reference file. Translated to /FR. 
Creates a Pass 1 listing.Translated to F1/ST. 

Defines a symbol. Unchanged. 

Emulates floating-point instructions. Translated to /FPi. 
Lists command-line arguments. Translated to /help. 
Calls QuickHelp for help on the MASM driver. 
Specifies an include path. Unchanged. 

Creates a normal listing. Translated to /FI. 

Lists all. Translated to /Fl and /Sa. 

Treats names as case sensitive. Translated to /Cp. 
Converts names to uppercase. Translated to /Cu. 
Preserves case on nonlocal names. Translated to /Cx. 
Suppresses table in listing file. Translated to /Sn. 


Checks for impure code. Use OPTION READONLY. 
Ignored. 


Orders segments sequentially. Results in a warning. 
Ignored. 


Enables terse assembly. Translated to /NOLOGO. 


Enables verbose assembly. Ignored. 


Environment 
Variables 


ML 


Syntax 
Options 


_ Option 


/Wlevel 


Xx 


IZ 
/ZD 
/ZI 


Variable 
INCLUDE 
MASM 
TMP 


Action 

Sets warning level, where /evel = 0, 1, or 2. 

Lists false conditionals. Translated to /Sx. 

Displays error lines on screen. Ignored. 

Generates line numbers for CodeView. Translated to /Zd. 


Generates symbols for CodeView. Translated to /Zi. 


Description 
Specifies default path for .INC files. 
Specifies default command-line options. 


Specifies path for temporary files. 


The ML program assembles and links one or more assembly-language source . 
files. The command-line options are case sensitive. 


ML [loptions]| filename [| [options] filename]... [[/link linkoptions]| 


Option 
/AT 


/Bl filename 

Ic 

/Cp 

/Cu 

/Cx 
/Dsymboll|=value]| 


/EP 


/Fhexnum 


Action 


Enables tiny-memory-model support. Enables error 
messages for code constructs that violate the requirements 
for .COM format files. Note that this is not equivalent to 
the .MODEL TINY directive. 


Selects an alternate linker. 

Assembles only. Does not link. 

Preserves case of all user identifiers. 

Maps all identifiers to uppercase (default). 
Preserves case in public and.extern symbols. 


Defines a text macro with the given name. If value is 
missing, it is blank. Multiple tokens separated by Spaces, 
must be enclosed in quotation marks. 


Generates a preprocessed source listing (sent to 
STDOUT). See /Sf. 


Sets stack size to hexnum bytes (this is the same as /link 
/STACK:number). The value must be expressed in 
hexadecimal notation. There must be a space between /F 
and hexnum. 


Option 
/Fefilename 
/Fil[filename]] 
/Fm[filename]] 
/Fofilename 
/FPi 


/Fri[filename] 
/FR[[filename]] 


/Gc 


/Gd 
/H number 


/help 
/I pathname 


/nologo 
/Sa 

[Sc 

/Sf 

Sg 

/S1] width 


/Sn 
/Sp length 


/Ss text 
/St text 
/Sx 


/Ta filename 


/w 
/Wlevel 
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Action 

Names the executable file. 

Generates an assembled code listing. See /Sf. 
Creates a linker map file. 

Names an object file. 


Generates emulator fixups for floating-point arithmetic 
(mixed-language only). 


Generates a Source Browser .SBR file. 


Generates an extended form of a Source Browser .SBR 
file. 


Specifies use of FORTRAN- or Pascal-style function 
calling and naming conventions. Same as OPTION 
LANGUAGE:PASCAL. 


Specifies use of C-style function calling and naming 
conventions. Same as OPTION LANGUAGE:C. 


Restricts external names to number significant characters. 
The default is 31 characters. 


Calls QuickHelp for help on ML. 


Sets path for include file. A maximum of 10 /I options is 
allowed. 


Suppresses messages for successful assembly. 
Turns on listing of all available information. 
Adds instruction timings to listing file. 

Adds first-pass listing to listing file. 

Turns on listing of assembly-generated code. 


Sets the line width of source listing in characters per line. 
Range is 60 to 255 or 0. Default is 0. Same as PAGE 
width, 


Turns off symbol table when producing a listing. 


Sets the page length of source listing in lines per page. 
Range is 10 to 255 or 0. Default is 0. Same as PAGE 
length. 


Specifies text for source listing. Same as SUBTITLE text. 
Specifies title for source listing. Same as TITLE text. 
Turns on false conditionals in listing. 


Assembles source file whose name does not end with the 
.ASM extension. 


Same as /WO. 


Sets the warning level, where /evel = 0, 1, 2, or 3. 


14 NMAKE 


QuickAssembler 
Support 


Environment 
Variables 


NMAKE 


Syntax 


Option 
/WX 
/Zd 
/Zf 

[Zi 
/Zm 


/Zp[alignment] 


/Zs 
/? 


Action 

Returns an error code if warnings are generated. 
Generates line-number information in object file. 
Makes all symbols public. 

Generates Code View information in object file. 


Enables M510 option for maximum compatibility with 
MASM 5.1. 


Packs structures on the specified byte boundary. The 
alignment may be 1, 2, or 4. 


Performs a syntax check only. 


Displays a summary of ML command-line syntax. 


For compatibility with QuickAssembler makefiles, ML recognizes these options: 


Option 
/a 


/Cl 
/Ez 
/P1 
/P2 
/s 


/Sq 


Variable 
INCLUDE 
ML 

TMP 


Action 


Orders segments alphabetically in QuickAssembler. 
MASM 6.1 uses the .ALPHA directive for alphabetical 
ordering and ignores /a. 


Equivalent to /Cp. 


Prints the source for error lines to the screen. MASM 6.1 
ignores this option. 


Performs one-pass assembly. MASM 6.1 ignores this 
option. 


Performs two-pass assembly. MASM 6.1 ignores this 
option. 


Orders segments sequentially. MASM 6.1 uses the SEQ 
directive for sequential ordering and ignores /s. 


Equivalent to /S10 /Sp0. 


Description 
Specifies search path for include files. 
Specifies default command-line options. 


Specifies path for temporary files. 


The NMAKE utility automates the process of compiling and linking project files. 


NMAKE [options] {[macros]] [[targets]| 


Options 


Environment 
Variable 


Option 
/A 
1c 


/D 
/E 


/F filename 


/HELP 
/I 


/N 
/NOLOGO 
/P 


/Q 


/R 


IS 
/T 


/X filename 


/Z 


f? 


Variable 


INIT 
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Action 
Executes all commands even if targets are not out-of-date. 


Suppresses the NMAKE copyright message and prevents nonfatal error 
or warning messages from being displayed. 


Displays the modification time of each file when the times of targets 
and dependents are checked. 


Causes environment variables to override macro definitions within 
description files. 


Specifies filename as the name of the description file to use. If a dash 
(—) is entered instead of a filename, NMAKE reads the description file 
from the standard input device. If /F is not specified, NMAKE uses 
MAKEFILE as the description file. If MAKEFILE does not exist, 
NMAKE builds command-line targets using inference rules. 


Calls QuickHelp for help on NMAKE. 


Ignores exit codes from commands in the description file. NUAKE 
continues executing the rest of the description file despite the errors. 


Displays but does not execute commands from the description file. 
Suppresses the NMAKE copyright message. 


Displays all macro definitions, inference rules, target descriptions, and 
the SSUFFIXES list. 


Checks modification times of command-line targets (or first target in 
the description file if no command-line targets are specified). NUAKE 
returns a zero exit code if all such targets are up-to-date and a nonzero 
exit code if any target is out-of-date. Only preprocessing commands in 
the description file are executed. 


Ignores inference rules and macros that are predefined or defined in the 
TOOLS.INI file. 


Suppresses display of commands as they are executed. 


Changes modification times of command-line targets (or first target in 
the description file if no command-line targets are specified) to the 
current time. Only preprocessing commands in the description file are 
executed. The contents of target files are not modified. 


Sends all error output to filename, which can be either a file or a 
device. If a dash (—) is entered instead of a filename, the error output is 
sent to the standard output device. 


Internal option for use by the Microsoft Programmer’s WorkBench 
(PWB). 


Displays a summary of NMAKE command-line syntax. 


Description 


Specifies path for TOOLS.INI file, which may contain macros, 
inference rules, and description blocks. . 
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PWB (Programmer’s WorkBench) 


The Microsoft Programmer’s WorkBench (PWB) provides an integrated 
environment for developing programs in assembly language. The command-line 


options are case sensitive. 


Syntax PWB [loptions]| [files] 
Options Option | 
: /Dilinit]] 


le cmdstr 


/m mark 


/Pllinit]] 


Ir 


Action 


Prevents PWB from examining initialization files, where 
init is one or more of the following characters: 


A Disable autoload extensions (including 
language-specific extensions and Help). 


SS. Ignore CURRENT.STS. 
T Ignore TOOLS.INI. 


If the /D option does not include an init character, it is 
equivalent to specifying /DAST (all files and extensions 
ignored). 


Executes the command or sequence of commands at start- 
up. The entire cmdstr argument must be placed in double 
quotation marks if it contains a space. If cmdstr contains 
literal double quotation marks, place a backslash (\) in 
front of each double quotation mark. To include a literal 
backslash in the command string, use double backslashes 
(\\). 


Moves the cursor to the specified mark instead of moving 
it to the last known position. The mark can be a line 
number. 


Specifies a program list for PWB to read, where init can 
be: 


Ffile Read a foreign program list (one not created 
using PWB). 
L Read the Jast program list. Use this option to 


start PWB in the same state you left it. 
Pfile Read a PWB program list. 


Starts PWB in no-edit mode. Functions that modify files 
are disallowed. 


Option 
[[/t]] file... 


f? 


Environment Variable 
Variables HELPFILES 
INIT 
TMP 


PWBRMAKE 
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Action 


Loads the specified file at startup. The file specification 
can contain wildcards. If multiple files are specified, PWB 
loads only the first file. When the Exit function is invoked, 
PWB saves the current file and loads the next file in the 
list. Files specified with /t are temporary; PWB does not 
add them to the file history on the File menu. 


No other options can follow /t on the command line. Each 
temporary file must be specified in a separate /t option. 


Displays a summary of PWB command-line syntax. 


Description 


Specifies path of help files or list of help filenames. 
Specifies path for TOOLS.INI and CURRENT.STS files. 
Specifies path for temporary files. 


PWBRMAKE converts the .SBR files created by the assembler into database 
.BSC files that can be read by the Microsoft Programmer’s WorkBench (PWB) 
Source Browser. The command-line options are case sensitive. 


Syntax PWBRMAKE [options] sbrfiles 
Options Option Action 
/Ei filename Excludes the contents of the specified include files from the 


/Ei (filename...) 
/Em 

/Es 

/HELP 


/Tu 
/n 


/o filename 
lv 
/? 


_ database. To specify multiple filenames, separate them with 


spaces and enclose the list in parentheses. 


Excludes symbols in the body of macros. Use /Em to include 
only macro names. 


Excludes from the database every include file specified with an 
absolute path or found in an absolute path specified in the 
INCLUDE environment variable. 


Calls QuickHelp for help on PWBRMAKE. 
Includes unreferenced symbols. 


Forces a nonincremental build and prevents truncation of .SBR 
files. 


Specifies a name for the database file. 
Displays verbose output. 


Displays a summary of PWBRMAKE command-line syntax. 
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QuickHelp 


Syntax 
Options 


The QuickHelp utility displays Help files. All MASM reserved words and error 
messages can be used for topic. 


QH [[options]| [topic] 


Option Action 

/d filename Specifies either a specific database name or a path where 
the databases are found. 

/\number Specifies the number of lines the QuickHelp window 
should occupy. 

/mnumber Changes the screen mode to display the specified number 
of lines, where number is in the range 25 to 60. 

/p filename Sets the name of the paste file. 

/pal[filename]| Specifies that pasting operations are appended to the 


current paste file (rather than overwriting the file). 


/q Prevents the version box from being displayed when 
QuickHelp is installed as a keyboard monitor. 


/t command Specifies the command that QuickHelp should execute 
when the right mouse button is pressed. The command can 
be one of the following letters: 


] Display last topic 


eo 


Display history of help topics 
Ww Hide window 

b Display previous topic 

é Find next topic 

t Display contents 


/s Specifies that clicking the mouse above or below the scroll 
box causes QuickHelp to scroll by lines rather than pages. 


Environment 
Variables 


RM 


Syntax 
Options 


Option 


/t name 


/u 


Variable 
HELPFILES 


QH 
TMP 


RM 


Action 


Directs QuickHelp to copy the specified section of the 
given topic to the current paste file and exit. The name 
may be: 


All Paste the entire topic 
Syntax Paste the syntax only 
Example Paste the example only 


If the topic is not found, QuickHelp returns an exit code 
of 1. 


Specifies that QuickHelp is being run by a utility. If the 
topic specified on the command line is not found, 
QuickHelp immediately exits with an exit code of 3. 


Description 


Specifies path of help files or list of help filenames. 
Specifies default command-line options. 


Specifies directory of default paste file. 
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The RM utility moves a file to a hidden DELETED subdirectory of the directory 
containing the file. Use the UNDEL utility to recover the file and the EXP utility 
to mark the hidden file for deletion. 


RM [[options]] [[files]] 


Option 

/F 

/HELP 

/I 

/K 

/R directory 
Ne 


Action 


Deletes read-only files without prompting. 
Calls QuickHelp for help on RM. 


Inquires for permission before removing each file. 


Keeps read-only files without prompting. 
Recurses into subdirectories of the specified directory. 


Displays a summary of RM command-line syntax. 
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UNDEL 


Syntax 
Options 


The UNDEL utility moves a file from a hidden DELETED subdirectory to the 
parent directory. UNDEL is used along with EXP and RM to manage backup 
files. 


UNDEL [[{ option | files}]| 
Option Action 
/HELP Calls QuickHelp for help on UNDEL. 


1? Displays a summary of UNDEL command-line syntax. 
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Topical Cross-reference for Directives 


Reference | 


Code Labels 
ALIGN 


LABEL 


Conditional Assembly 


ELSE 
ENDIF 
IFB/IFNB 
IFE 


EVEN 
ORG 


ELSEIF 

IF 
IFDEF/IFNDEF 
IFIDN/IFIDNI 


Conditional Control Flow 


-BREAK 
-ELSEIF 

AF 
UNTILCXZ 


Conditional Error 
ERR 


-ERRDEF 
-ERRIDN/.ERRIDNI 
-ERRNZ 


Data Allocation 
ALIGN 


EVEN 

ORG 

REAL8 
WORD/SWORD 


Equates 


EQU 
TEXTEQU 


CONTINUE 
ENDIF 
-REPEAT 
.WHILE 


-ERR2 
-ERRDIF/.ERRDIFI 
-ERRNB 


BYTE/SBYTE 
FWORD 
QWORD 
REAL10 


ELSEIF2 
IF2 
IFDIF/IFDIFI 


.ELSE 
.ENDW 
-UNTIL/ 


-ERRB 
-ERRE 
-ERRNDEF 


DWORD/SDWORD 
LABEL 
REAL4 
TBYTE 


Listing Control 
.CREF 


-LISTIF 
.NOCREF 
.NOLISTMACRO 
.TFCOND 


Macros 
ENDM 


LOCAL 


Miscellaneous 
ASSUME 


END 
OPTION 
“RADIX 


Procedures 
ENDP 


PROTO 


Processor 
.186 


287 
387 
8086 


Repeat Blocks 
ENDM 


GOTO 


Scope 
COMM 
INCLUDELIB 


.LIST 
-.LISTMACRO 
.NOLIST 
PAGE 

TITLE 


EXITM 
MACRO 


COMMENT 
INCLUDE 


POPCONTEXT 


INVOKE 
USES 


.286 
386 
486 
.8087 


FOR 
REPEAT 


EXTERN 
PUBLIC 


Directives 


-LISTALL 
LLISTMACROALL 
-NOLISTIF 
SUBTITLE 


GOTO 
PURGE 


ECHO 
INCLUDELIB 
PUSHCONTEXT 


PROC 


.286P 
.386P 
A86P 
.NO87 


FORC 


WHILE 


EXTERNDEF 
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Reference — 


Segment 
-ALPHA 


END 
SEGMENT 


Simplified Segment 
CODE 

DATA? 
FARDATA 
STACK 


String 
CATSTR 
SIZESTR 


Structure and Record 
ENDS 


TYPEDEF 


ASSUME 
ENDS 
SEQ 


CONST . 
.DOSSEG 
-FARDATA? 
STARTUP 


INSTR 
SUBSTR 


RECORD 
UNION 


-.DOSSEG 
GROUP 


DATA 
.EXIT 
-MODEL 


STRUCT 


Directives 
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name = expression 
Assigns the numeric value of expression to name. The symbol may be 
redefined later. 


186 
Enables assembly of instructions for the 80186 processor; disables assembly 
of instructions introduced with later processors. Also enables 8087 
instructions. 


.286 
Enables assembly of nonprivileged instructions for the 80286 processor; 
disables assembly of instructions introduced with later processors. Also 
enables 80287 instructions. 


.286P 
Enables assembly of all instructions (including privileged) for the 80286 
processor; disables assembly of instructions introduced with later processors: 
Also enables 80287 instructions. 


.287 
Enables assembly of instructions for the 80287 coprocessor; disables assembly 
of instructions introduced with later coprocessors. 


386 
Enables assembly of nonprivileged instructions for the 80386 processor; 
disables assembly of instructions introduced with later processors. Also 
enables 80387 instructions. 


.386P 

Enables assembly of all instructions (including privileged) for the 80386 
processor; disables assembly of instructions introduced with later processors. 
Also enables 80387 instructions. 


387 
Enables assembly of instructions for the 80387 coprocessor. 


.486 
Enables assembly of nonprivileged instructions for the 80486 processor. 


.486P 
Enables assembly of all instructions (including privileged) for the 80486 
processor. . 


8086 
Enables assembly of 8086 instructions (and the identical 8088 instructions); 
disables assembly of instructions introduced with later processors. Also 
enables 8087 instructions. This is the default mode for processors. 
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8087 
Enables assembly of 8087 instructions; disables assembly of instructions 
introduced with later coprocessors. This is the default mode for coprocessors. 


ALIGN [number] 
Aligns the next variable or instruction on a byte that is a multiple of number. 


ALPHA 
Orders segments alphabetically. 


ASSUME segregister:name [, segregister:name]... 

ASSUME dataregister:type {[, dataregister:type]... 

ASSUME register;ERROR [,, register:ERROR]J... 

ASSUME [lregister:]] NOTHING [[, register: NOTHING]... 
Enables error-checking for register values. After an ASSUME is put into 
effect, the assembler watches for changes to the values of the given registers. 
ERROR generates an error if the register is used. NOTHING removes 
register error-checking. You can combine different kinds of assumptions in 
one statement. 

-BREAK [.IF condition] 
Generates code to terminate a .WHILE or .REPEAT block if condition is 
true. 

[[name]] BYTE initializer [[, initializer]... 
Allocates and optionally initializes a byte of storage for each initializer. Can 
also be used as a type specifier anywhere a type is legal. 

name CATSTR [[textitem] |, textitem2]]...]] 
Concatenates text items. Each text item can be a literal string, a constant 
preceded by a %, or the string returned by a macro function. 

~ .CODE [name] 

When used with .MODEL, indicates the start of a code segment calléd name 
(the default segment name is _TEXT for tiny, small, compact, and flat models, 
or module_TEXT for other models). 

COMM definition [[, definition]] ... 
Creates a communal variable with the attributes specified in definition. Each 
definition has the following form: 
[[/angtype]] [NEAR | FAR] /abel:type[:count] 
The /abel is the name of the variable. The type can be any type specifier 
(BYTE, WORD, and so on) or an integer specifying the number of bytes. The 
count specifies the number of data objects (one is the default). 

COMMENT delimiter ([text]| 
[[text]] 


[[text]] delimiter [[text]] 


Treats all text between or on the same line as the delimiters as a comment. 
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-CONST 
When used with .MODEL, starts a constant data segment (with segment name 
CONST). This segment has the read-only attribute. 


-CONTINUE [.IF condition] 
Generates code to jump to the top of a. WHILE or .REPEAT block if 
condition is true. 


-CREF 
Enables listing of symbols in the symbol portion of the symbol table and 
browser file. 


DATA 
When used with .MODEL, starts a near data segment for initialized data 
(segment name _DATA). 


-DATA? 
When used with .MODEL, starts a near data segment for uninitialized data 
(segment name _BSS). 


-DOSSEG 
Orders the segments according to the MS-DOS segment convention: CODE 
first, then segments not in DGROUP, and then segments in DGROUP. The 
segments in DGROUP follow this order: segments not in BSS or STACK, 
then BSS segments, and finally STACK segments. Primarily used for ensuring 
CodeView support in MASM stand-alone programs. Same as DOSSEG. 


DOSSEG 
Identical to .DOSSEG, which is the preferred form. 


DB 
Can be used to define data like BYTE. 


DD 
Can be used to define data like DWORD. 


DF 

Can be used to define data like FWORD. 
DQ 

Can be used to define data like QWORD. 


DT 
Can be used to define data like TBYTE. 


DW 
Can be used to define data like WORD. 

[[zame]] DWORD initializer ||, initializer]... 
Allocates and optionally initializes a doubleword (4 bytes) of storage for each 
initializer. Can also be used as a type specifier anywhere a type is legal. 


ECHO message 
Displays message to the standard output device (by default, the screen). Same 
as %OUT. 
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-ELSE 
See IF. 
ELSE 
Marks the beginning of an alternate block within a conditional block. See IF. 
ELSEIF 
Combines ELSE and IF into one statement. See IF. 
ELSEIF2 
ELSEIF block evaluated on every assembly pass if OPTION:SETIEF2 is 
TRUE. 
END [[address]] 
Marks the end of a module and, optionally, sets the program entry point to 
address. 
-ENDIF 
See .IF. 
ENDIF 
See IF. 
ENDM 
Terminates a macro or repeat block. See MACRO, FOR, FORC, REPEAT, 
or WHILE. 
name ENDP 
Marks the end of procedure name previously begun with PROC. See PROC. 
name ENDS 
Marks the end of segment, structure, or union name previously begun with 
SEGMENT, STRUCT, UNION, or a simplified segment directive. 
-ENDW 
See .WHILE. 
name EQU expression 
Assigns numeric value of expression to name. The name cannot be redefined 
later. | 
name EQU <text> 
Assigns specified text to name. The name can be assigned a different text _ 
later. See TEXTEQU. 
-ERR [[message]] 
Generates an error. 
-ERR2 [[message]] 
-ERR block evaluated on every assembly pass if OPTION:SETIF2 is TRUE. 
-ERRB <textitem> [[, message]] 
Generates an error if textitem is blank. 


-ERRDEF name [[, message] 
Generates an error if name is a previously defined label, variable, or symbol. 
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-ERRDIF[I]] <textitem1>, <textitem2> [, message] 
Generates an error if the text items are different. If I is given, the comparison 
is case insensitive. 


-ERRE expression [[, message] 
Generates an error if expression is false (0). 


‘ERRIDN{[I]] <textitem1>, <textitem2> [[, message] 
Generates an error if the text items are identical. If I is given, the comparison 
is Case insensitive. 


-ERRNB <¢extitem> [[, message] 
Generates an error if textitem is not blank. 


-ERRNDEF name [, message] 
Generates an error if name has not been defined. 


-ERRNZ expression [[, message]] 
Generates an error if expression is true (nonzero). 


EVEN 
Aligns the next variable or instruction on an even byte. 


EXIT [[expression]] 
Generates termination code. Returns optional expression to shell. 


EXITM [[textitem]] 
Terminates expansion of the current repeat or macro block and begins 
assembly of the next statement outside the block. In a macro function, textitem 
is the value returned. | 


EXTERN [[langtype] name [[(altid)]] :type [[, [/angtype]] name [[(altid)]] :type]... 
Defines one or more external variables, labels, or symbols called name whose 
type is type. The type can be ABS, which imports name as a constant. Same as 
EXTRN. 


EXTERNDEF [[langtype]] name:type [,, [[/angtype] name:type]... 
Defines one or more external variables, labels, or symbols called name whose 
type is type. If name is defined in the module, it is treated as PUBLIC. If 
name is referenced in the module, it is treated as EXTERN. If name is not 
referenced, it is ignored. The type can be ABS, which imports name as a 
constant. Normally used in include files. 


EXTRN 
See EXTERN. 


-FARDATA [[name]] 
When used with .MODEL, starts a far data segment for initialized data 
(segment name FAR_DATA or name). 

-FARDATA? [name] © 
When used with .MODEL, starts a far data segment for uninitialized data 
(segment name FAR_BSS or name). 
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FOR parameter [[: REQ | :=default]] , <argument [[, argument]]...> 
statements 


ENDM 
Marks a block that will be repeated once for each argument, with the 
current argument replacing parameter on each repetition. Same as IRP. 
FORC . 
parameter, <string> statements 
ENDM 
Marks a block that will be repeated once for each character in string, with 
the current character replacing parameter on each repetition. Same as 
IRPC. 
[[name]] FWORD initializer [[, initializer]... 
Allocates and optionally initializes 6 bytes of storage for each initializer. Also 
can be used as a type specifier anywhere a type is legal. 
GOTO macrolabel 
Transfers assembly to the line marked :macrolabel. GOTO is permitted only 
inside MACRO, FOR, FORC, REPEAT, and WHILE blocks. The label 
must be the only directive on the line and must be preceded by a leading 
colon. 
name GROUP segment [[, segment]... 
Add the specified segments to the group called name. 
AF condition! 
Statements 


[| ELSEIF condition2 
statements || 


[| ELSE 
statements || 


ENDIF 


Generates code that tests condition! (for example, AX > 7) and executes 
the statements if that condition is true. If an .ELSE follows, its statements 
are executed if the original condition was false. Note that the conditions 
are evaluated at run time. 


IF expression1 

ifstatements 

([ELSEIF expression2 
elseifstatements]| 

(IELSE 
elsestatements]| 

ENDIF 
Grants assembly of ifstatements if expression! is true (nonzero) or 
elseifstatements if expression! is false (0) and expression2 is true. The 
following directives may be substituted for ELSEIF: ELSEIFB, 
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ELSEIFDEF, ELSEIFDIF, ELSEIFDIFI, ELSEIFE, ELSEIFIDN, 
ELSEIFIDNI, ELSEIFNB, and ELSEIFNDEF. Optionally, assembles 
elsestatements if the previous expression is false. Note that the expressions 
are evaluated at assembly time. 


IF2 expression 
IF block is evaluated on every assembly pass if OPTION:SETIF2 is TRUE. 
See IF for complete syntax. 


IFB textitem 
Grants assembly if textitem is blank. See IF for complete syntax. 


IFDEF name 
Grants assembly if name is a previously defined label, variable, or symbol. 
See IF for complete syntax. 


IFDIF [I] textitem1, textitem2 
Grants assembly if the text items are different. If I is given, the comparison is 
case insensitive. See IF for complete syntax. 


IFE expression 
Grants assembly if expression is false (0). See IF for complete syntax. 


IFIDN[I]] textitem1, textitem2 
Grants assembly if the text items are identical. If I is given, the comparison is 
case insensitive. See IF for complete syntax. 


IFNB textitem 
Grants assembly if textitem is not blank. See IF for complete syntax. 


IFNDEF name 
Grants assembly if name has not been defined. See IF for complete syntax. 


INCLUDE filename 
Inserts source code from the source file given by filename into the current 
source file during assembly. The filename must be enclosed in angle brackets 
if it includes a backslash, semicolon, greater-than symbol, less-than symbol, 
single quotation mark, or double quotation mark. 


INCLUDELIB libraryname 
Informs the linker that the current module should be linked with libraryname. 
The libraryname must be enclosed in angle brackets if it includes a backslash, 
semicolon, greater-than symbol, less-than symbol, single quotation mark, or 
double quotation mark. 


name INSTR [[position,]] textitem1, textitem2 
Finds the first occurrence of textitem2 in textitem1. The starting position is 
optional. Each text item can be a literal string, a constant preceded by a %, or 
the string returned by a macro function. 
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INVOKE expression [[, arguments] 
Calls the procedure at the address given by expression, passing the arguments 
on the stack or in registers according to the standard calling conventions of the 
language type. Each argument passed to the procedure may be an expression, 
a register pair, or an address expression (an expression preceded by ADDR). 
IRP | 
See FOR. 
IRPC 
See FORC. 
name LABEL type 
Creates a new label by assigning the current location-counter value and the 
given type to name. . 
name LABEL [NEAR | FAR | PROC] PTR [type] 
Creates a new label by assigning the current location-counter value and the 
given type to name. 
-LALL 
See LLISTMACROALL. 
-LFCOND 
See .LISTIF. 
«LIST 
Starts listing of statements. This is the default. 
s<LISTALL 
Starts listing of all statements. Equivalent to the combination of .LIST, 
-LISTIF, and .LISTMACROALL. 
-LISTIF 
Starts listing of statements in false conditional blocks. Same as .LFCOND. | 
-LISTMACRO 
Starts listing of macro expansion statements that generate code or data. This is 
the default. Same as .XALL. 
-LISTMACROALL 
Starts listing of all statements in macros. Same as .LALL. 
~ LOCAL localname [[, localname]... 
Within a macro, LOCAL defines labels that are unique to each instance of the © 
macro. 


LOCAL label [{[ [count ] I] [:typel]l I, label [[ [count] ]] [type] ]... 
Within a procedure definition (PROC), LOCAL creates stack-based variables 
that exist for the duration of the procedure. The /abel may be a simple variable 
or an array containing count elements. 
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name MACRO [[parameter [:REQ | :=default |: VARARGJJ... 
statements 
ENDM [value] 
Marks a macro block called name and establishes parameter placeholders 
for arguments passed when the macro is called. A macro function returns 
value to the calling statement. 


-MODEL memorymodel [, langtype]] [[, stackoption] 
Initializes the program memory model. The memorymodel can be TINY, 
SMALL, COMPACT, MEDIUM, LARGE, HUGE, or FLAT. The Jangtype 
can be C, BASIC, FORTRAN, PASCAL, SYSCALL, or STDCALL. The 
stackoption can be NEARSTACK or FARSTACK. 


NAME modulename 
Ignored. 


.NO87 
Disallows assembly of all floating-point instructions. 


-NOCREF [[xame[, name]]...]] 
Suppresses listing of symbols in the symbol table and browser file. If names 
are specified, only the given names are suppressed. Same as .KCREF. 


-NOLIST 
Suppresses program listing. Same as .XLIST. 


-NOLISTIF | 
Suppresses listing of conditional blocks whose condition evaluates to false (0). 
This is the default. Same as SFCOND. 


-NOLISTMACRO 
Suppresses listing of macro expansions. Same as .SALL. 


OPTION optionlist 
Enables and disables features of the assembler. Available options include 
CASEMAP, DOTNAME, NODOTNAME, EMULATOR, 
NOEMULATOR, EPILOGUE, EXPR16, EXPR32, LANGUAGE, LJMP, 
NOLJMP, M510, NOM510, NOKEYWORD, NOSIGNEXTEND, 
OFFSET, OLDMACROS, NOOLDMACROS, OLDSTRUCTS, 
NOOLDSTRUCTS, PROC, PROLOGUE, READONLY, 
“NOREADONLY, SCOPED, NOSCOPED, SEGMENT, and SETIF2. 


ORG expression 
Sets the location counter to expression. 


% OUT 
See ECHO. 

PAGE [[[[/ength]], width] 
Sets line /ength and character width of the program listing. If no arguments are 
given, generates a page break. 
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PAGE + 
Increments the section number and resets the page number to 1. 


POPCONTEXT context 
Restores part or all of the current context (saved by the PUSHCONTEXT 
directive). The context can bb ASSUMES, RADIX, LISTING, CPU, or 
ALL. 


label PROC [[distance]] [langtype] [visibility] [<prologuearg>]| 
[USES reglist]] [[, parameter [[:tag]]]... 
statements 
label ENDP 
Marks start and end of a procedure block called /abel. The statements in 
the block can be called with the CALL instruction or INVOKE directive. 


label PROTO [[distance]| [langtype] [, [parameter]|:tag]... 
Prototypes a function. 


PUBLIC [[/angtype]] name [, [[/angtype]| name]... 
Makes each variable, label, or absolute symbol specified as name available to 
all other modules in the program. 


PURGE macroname [[, macroname]... 
Deletes the specified macros from memory. 


PUSHCONTEXT context 
Saves part or all of the current context: segment register assumes, radix value, 
listing and cref flags, or processor/coprocessor values. The context can be 
ASSUMES, RADIX, LISTING, CPU, or ALL. 


[[name]] QWORD initializer [[, initializer]... 
Allocates and optionally initializes 8 bytes of storage for each initializer. Also 
can be used as a type specifier anywhere a type is legal. 


-RADIX expression 
Sets the default radix, in the range 2 to 16, to the value of expression. 


name REAL4 initializer |, initializer]... 
Allocates and optionally initializes a single-precision (4-byte) floating-point 
number for each initializer. 

name REALS initializer [[, initializer]... 


Allocates and optionally initializes a double-precision (8-byte) floating-point 
number for each initializer. 


name REAL10 initializer [, initializer]... 
Allocates and optionally initializes a 10-byte floating-point number for each 
initializer. 
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recordname RECORD fieldname:width [= expression] 
[_, fieldname:width [[= expression]]]... 
Declares a record type consisting of the specified fields. The fieldname names 
the field, width specifies the number of bits, and expression gives its initial 
value. 


-REPEAT 
statements 
-UNTIL condition 
Generates code that repeats execution of the block of statements until 
condition becomes true. .UNTILCXZ, which becomes true when CX is 
zero, may be substituted for .UNTIL. The condition is optional with 
-UNTILCXZ. 


REPEAT expression 
statements 
ENDM 
Marks a block that is to be repeated expression times. Same as REPT. 


REPT 
See REPEAT. 


SALL 
See .NOLISTMACRO. 


name SBYTE initializer [[, initializer]]... 
Allocates and optionally initializes a signed byte of storage for each initializer. 
Can also be used as a type specifier anywhere a type is legal. 


name SDWORD initializer [[, initializer]... 
Allocates and optionally initializes a signed doubleword (4 bytes) of storage 
for each initializer. Also can be used as a type specifier anywhere a type is 
legal. 


name SEGMENT [READONLY] [align] [combine] Quse]| ['class'] 
statements 
name ENDS 
Defines a program segment called name having segment attributes align 
(BYTE, WORD, DWORD, PARA, PAGE), combine (PUBLIC, 
STACK, COMMON, MEMORY, AT address, PRIVATE), use 
(USE16, USE32, FLAT), and class. 


SEQ 

Orders segments sequentially (the default order). 
SSFCOND 

See .NOLISTIF. 


name SIZESTR textitem 
Finds the size of a text item. 
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STACK [size]] 
When used with .MODEL, defines a stack segment (with segment name 
STACK). The optional size specifies the number of bytes for the stack (default 
1,024). The STACK directive automatically closes the stack statement. 


STARTUP 
Generates program start-up code. 

STRUC 
See STRUCT. 

name STRUCT [alignment] [|, NONUNIQUE] 
fielddeclarations 
name ENDS 

Declares a structure type having the specified fielddeclarations. Each field 
must be a valid data definition. Same as STRUC. 

name SUBSTR textitem, position [[, length]] 
Returns a substring of textitem, starting at position. The textitem can be a 
literal string, a constant preceded by a %, or the ene returned by a macro 
function. 

SUBTITLE text 
Defines the listing subtitle. Same as SUBTTL. 

‘SUBTTL 
See SUBTITLE. 

name SWORD initializer [,, initializer]... 
Allocates and optionally initializes a signed word (2 bytes) of storage for each 
initializer. Can also be used as a type specifier anywhere a type is legal. 

[[name]| TBYTE initializer [[, initializer]... 

Allocates and optionally initializes 10 bytes of storage for each initializer. Can 
also be used as a type specifier anywhere a type is legal. 

name TEXTEQU I[[textitem]] 
Assigns textitem to name. The textitem can be a literal string, a-constant 
preceded by a %, or the string returned by a macro function. 


-TFCOND 

Toggles listing of false conditional blocks. 
TITLE text 

Defines the program listing title. 


name TYPEDEF type 
Defines a new type called name, afich3 is equivalent to type. 
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name UNION [alignment] [, NONUNIQUE] 
fielddeclarations 

[[name]] ENDS 
Declares a union of one or more data types. The fielddeclarations must be 
valid data definitions. Omit the ENDS name label on nested UNION 


definitions. 
-UNTIL 

See .REPEAT. 
-UNTILCXZ 

See .REPEAT. 
-WHILE condition 

Statements 


-ENDW 


Generates code that executes the block of statements while condition 
remains true. 
WHILE expression 
Statements 


ENDM 


Repeats assembly of block statements as long as expression remains true. 


[[name]] WORD initializer [[, initializer]... 
Allocates and optionally initializes a word (2 bytes) of storage for each 
initializer. Can also be used as a type specifier anywhere a type is legal. 
XALL | 
See .LISTMACRO. 
-XCREF 
See .NOCREF. 
XLIST 
See .NOLIST. 
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Reference 


Date and Time Information 
@Date 


@Time 


Environment Information 
@Cpu 

@Environ 

@Interface 

@Version 


File Information 
@FileCur 
@FileName 
@Line 


Macro Functions 
@CatStr 

@InStr 

@SizeStr 
@SubStr 


Miscellaneous 
$ ? 
@B @F 


Segment Information 

@code @CodeSize 
@data . @DataSize 
@fardata? @Model 
@WordSize 


@@: 


@CurSeg 
@fardata 
@stack 


Arithmetic 
* 


MOD 


Control Flow 


Logical and Shift 
AND 


SHL 
Macro 
! 


Miscellaneous 


>9 


DUP 
SIGN? 


Record 
MASK 


WIDTH 


Relational 
EQ 
LE 
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OVERFLOW? 
ZERO? 


GE 
LT 
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VA 
| 


XOR 


GT 
NE 
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Segment 


LROFFSET 
OFFSET 
SEG 


Type 
HIGH ~ 


LENGTHOF 
OPATTR 
SIZE 

TYPE 


HIGHWORD 
LOW 

PTR 

SIZEOF 


LENGTH 
LOWWORD 
SHORT 
THIS 


Symbols and Operators 43 


Predefined Symbols 
$ 


The current value of the location counter. 


In data declarations, a value that the assembler allocates but does not initialize. 


@@: 

~ Defines a code label recognizable only between /abell and label2, where label] 
is either start of code or the previous @@: label, and /abel2 is either end of 
code or the next @@: label. See @B and @F. 


@B 
The location of the previous @@: label. 
@CatStr( string! [, string2...]] ) 
Macro function that concatenates one or more strings. Returns a string. 


@code 
The name of the code segment (text macro). 


@CodeSize 


0 for TINY, SMALL, COMPACT, and FLAT models, and 1 for MEDIUM, 
LARGE, and HUGE models (numeric equate). 


@Cpu 
A bit mask specifying the processor mode (numeric equate). 

@CurSeg 
The name of the current segment (text macro). 

' @data 

The name of the default data group. Evaluates to DGROUP for all models 
except FLAT. Evaluates to FLAT under the FLAT memory model (text 
macro). 


@DataSize 
0 for TINY, SMALL, MEDIUM, and FLAT models, 1 for COMPACT and 
LARGE models, and 2 for HUGE model (numeric equate). 


@Date 
The system date in the format mm/dd/yy (text macro). 


@Environ( envvar ) 

Value of environment variable envvar (macro function). . 
@F 

The location of the next @@: label. 


@fardata 
The name of the segment defined by the .FARDATA directive (text macro). 


@fardata? 
The name of the segment defined by the FARDATA? directive (text macro). 
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@FileCur 
The name of the current file (text macro). 


@FileName 
The base name of the main file being assembled (text macro). 

@InStr( [position], string], string2 ) 
Macro function that finds the first occurrence of string2 in string], beginning at 
position within string]. If position does not appear, search begins at start of 
string], Returns a position integer or 0 if string2 is not found. 


@Interface 
Information about the language parameters (numeric equate). 

@Line 
The source line number in the current file (numeric equate). 

@Model 
1 for TINY model, 2 for SMALL model, 3 for COMPACT model, 4 for 
MEDIUM model, 5 for LARGE model, 6 for HUGE model, and 7 for FLAT 
model (numeric equate). 


@SizeStr( string ) 
Macro function that returns the length of the given string. Returns an integer. 


@SubStr( string, position [[, length]] ) 
Macro function that returns a substring starting at position. 


@stack 

DGROUPFP for near stacks or STACK for far stacks (text macro). 
@Time 

The system time in 24-hour hh:mm:ss format (text macro). 


@Version 
610 in MASM 6.1 (text macro). 


@WordSize 
Two for a 16-bit segment or 4 for a 32-bit segment (numeric equate). 


expression + expression2 
Returns expression! plus expression2. 


expressionl — expression2 
Returns expression1 minus expression2. 


expressionl * expression2 
Returns expression! times expression2. 


expressionl | expression2 
Returns expression! divided by expression2. 
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—expression 
Reverses the sign of expression. 


expressionl [expression2] 
Returns expression! plus [expression2]. 


Segment: expression 
Overrides the default segment of expression with segment. The segment can be 
a segment register, group name, segment name, or segment expression. The 
expression must be a constant. 


expression. field |. field]... 
Returns expression plus the offset of field within its structure or union. 
[register]. field |. field]... 
Returns value at the location pointed to by register plus the offset of field within 
its structure or union. 


<text> 
Treats text as a single literal element. 


“text” 
Treats “text” as a string. 


text? 
Treats ’text’ as a string. 


!character 
Treats character asa literal character rather than as an operator or symbol. 


stext 
Treats text as a comment. 

53fext 
Treats text as a comment in a macro that appears only in the macro definition. 
The listing does not show text where the macro is expanded. 


%oexpression 
Treats the value of expression in a macro argument as text. 


&parameter& 
Replaces parameter with its corresponding argument value. 


ABS 
See the EXTERNDEF directive. 


ADDR 
See the INVOKE directive. 


expression! AND expression2 
Returns the result of a bitwise AND operation for expression1 and expression2. 


count DUP (initialvalue [[, initialvalue]]...) 
Specifies count number of declarations of initialvalue. 
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expression1 EQ expression2 
Returns true (—1) if expression! equals expression2, or returns false (0) if it 
does not. 


expressionl GE expression2 
Returns true (—1) if expression! is greater-than-or-equal-to expression2, or 
returns false (0) if it is not. 


expressionl GT expression2 
Returns true (—1) if expression! is greater than expression2, or returns false (0) 
if it is not. 

HIGH expression 
Returns the high byte of expression. 


HIGHWORD expression 
Returns the high word of expression. 


expression] LE expression2 
Returns true (—1) if expression! is less than or equal to expression2, or returns 
false (0) if it is not. 


LENGTH variable 
Returns the number of data items in variable created ye the first initializer. 


LENGTHOF variable 
Returns the number of data objects in variable. 


LOW expression 
Returns the low byte of expression. 


LOWWORD expression 
Returns the low word of expression. 


LROFFSET expression 
Returns the offset of expression. Same as OFFSET, but it seneick a loader 
resolved offset, which allows Windows to relocate code segments. 


expressionl LT expression2 
Returns true (—1) if expression] is less than expression2, or returns false (O) if 
it is not. 


MASK {recordfieldname | record} 
Returns a bit mask in which the bits in recordfieldname or record are set and 
all other bits are cleared. 


expression] MOD expression2 
Returns the integer value of the remainder (modulo) when dividing expression] 
by expression2. 


expression] NE expression2 
Returns true (—1) if expression! does not equal expression2, or returns false (0) 
if it does. 
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NOT expression 
Returns expression with all bits reversed. 


OFFSET expression 
Returns the offset of expression. 


OPATTR expression 
Returns a word defining the mode and scope of expression. The low byte is 
identical to the byte returned by .TYPE. The high byte contains additional 
information. 


expression] OR expression2 
Returns the result of a bitwise OR operation for expression] and expression2. 


type PTR expression 
Forces the expression to be treated as having the specified type. 


[[distance]| PTR type 
Specifies a pointer to type. 


SEG expression 
Returns the segment of expression. 


expression SHL count 
Returns the result of shifting the bits of expression left count number of bits. 


SHORT label 
Sets the type of /abel to short. All jumps to /abel must be short (within the range 
—128 to +127 bytes from the jump instruction to ace 


expression SHR count 
Returns the result of shifting the bits of expression right count aunibes of bits. 


SIZE variable 
Returns the number of bytes in variable allocated by the first initializer. 


SIZEOF {variable | type} . 
Returns the number of bytes in variable or type. - 


THIS type 
Returns an operand of specified type whose offset and segment values are equal 
to the current location-counter value. 


-TYPE expression 
See OPATTR. 


TYPE expression 
Returns the type of expression. 


WIDTH {recordfieldname \ record} 
Returns the width in bits of the current recordfieldname or record. 


expression] XOR expression2 
Returns the result of a bitwise XOR operation for expression! and expression2. 
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Run-Time Operators 


The following operators are used only within .IF, .WHILE, or .REPEAT blocks 
and are evaluated at run time, not at assembly time: 


expression] == expression2 
Is equal to. 

expressionl != expression2 
Is not equal to. 


expression] > expression2 
Is greater than. 


expression] >= expression2 
Is greater than or equal to. 


expression] < expression2 
Is less than. 


expressionl <= expression2 
Is less than or equal to. 


expressionI || expression2 
Logical OR. 


expression] & & expression2 
Logical AND. 


expressionl & expression2 
Bitwise AND. 
!expression 
Logical negation. 


CARRY? 
Status of carry flag. 


OVERFLOW? 
Status of overflow flag. 


PARITY? 

Status of parity flag. 
SIGN? 

Status of sign flag. 


ZERO? 
Status of zero flag. 
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Arithmetic 
ADC 


DIV 
INC 
SBB 


BCD Conversion 
AAA 
AAS 


Bit Operations 
AND 


BTS 
BTSs 
RCL 
ROR 
SHLDs 
XOR 


Compare 
BTS 


BTS$ 
CMPXCHG# 


Conditional Set 
SETA/SETNBEs 


SETBE/SETNAS 
SETG/SETNLES 
SETLE/SETNGs 
SETNOs 

SETOS 


* 80186-80486 only. 
§ 80386-80486 only. 


ADD 


SETAE/SETNB3 
SETCSs 
SETGE/SETNLS 
SETNCs 
SETNP/SETPOSs 
SETP/SETPEs 


+ 80286-80486 only. 


# 80486 only. 


Topical Cross-reference for Processor Instructions 


BTRS 
CMPS 


SETB/SETNAES 
SETE/SETZ8 
SETL/SETNGES 
SETNE/SETNZ5 
SETNSS 

SETS 


Conditional Transfer 


BOUND* 
JAE/JNB 
JC 
JG/JNLE 
JLE/JNG 
JNO 

JO 


Data Transfer 
BSWAP# 


LEA 
MOV 
MOVZXs 
XCHG 


Flag 
CLC 


CMC 
PUSHF 
STD 


Input/Output 
IN 


OUT 


Loop 
JCXZ/JECXZ 


LOOPE/LOOPZ 


* 80186-80486 only. 


$ 80386-80486 only. 


INTO 
JB/JNAE 
JCXZ/JECXZ 
JGE/JINL 
JNC 

JNP/JPO 
JP/JPE 


CMPXCHG# 
LFS/LGS/LSSS 
MOVS 

STOS 
XLAT/XLATB 


CLD 
LAHF 
SAHF 
STI 


INS* 
OUTS* 


LOOP 


LOOPNE/LOOPNZ 


+ 80286-80486 only. 


# 80486 only. 


Processor 


JA/INBE 
JBE/INA 
JE/JZ 
JL/JNGE 
JNE/JNZ 
JNS 

JS 


LDS/LES 
LODS 
MOVSXs 
XADD# 


CLI 
POPF 
STC 
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Process Control 
ARPL+ 
LGDT/LIDT/LLDT+ 
LTR+ 

STRt 

MOV specials 
WBINVD# 


Processor Control 
HLT 


NOP 


Stack 
PUSH 


PUSHAD* 
POPA* 
LEAVE* 


String 

MOVS 

SCAS 

OUTS* 
REPNE/REPNZ 


Type Conversion 
CBW 


CWDEs 
BSWAP# 


CLTS+ 

LMSW+ 
SGDT/SIDT/SLDT+ 
VERR}F 

INVD# 


LOCK 
WAIT 


CWD 
CDQ: 


Unconditional Transfer 


CALL 
RET 


* 80186-80486 only. 
§ 80386-80486 only. 


INT 
RETN/RETF 


F 80286-80486 only. 
# 80486 only. 


LAR 
LSLT 
SMSW+ 
VERW7{ 
INVLPG# 


PUSHA* 
POPF 
ENTER* 


STOS 
INS* 
REPE/REPZ 


IRET 
JMP 
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Interpreting Processor Instructions 


The following sections explain the format of instructions for the 8086, 8088, 80286, 
80386, and 80486 processors. Those instructions begin on page 64. 


Flags 


Only the flags common to all processors are shown. If none of the flags is affected 
by the instruction, the flag line says No change. If flags can be affected, a two-line 
entry is shown. The first line shows flag abbreviations as follows: 


Abbreviation Flag 

O Overflow 

D Direction 

I Interrupt 

T Trap 

S Sign 

Z Zero 

A Auxiliary carry 
P Parity 

C Carry 


The second line has codes indicating how the flag can be affected: 


Code Effect 

1 Sets the flag 

0 Clears the flag 

i May change the flag, but the value is not predictable 
blank No effect on the flag 


Be Modifies according to the rules associated with the flag 
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Syntax 


_ Each encoding variation may have different syntaxes corresponding to different 


addressing modes. The following abbreviations are used: 
reg A general-purpose register of any size. 


segreg One of the segment registers: DS, ES, SS, or CS (also FS or GS on the 
80386-80486). 


accum An accumulator register of any size: AL or AX (also EAX on the 
80386-80486). 


mem A direct or indirect memory operand of any size. 

label A labeled memory location in the code segment. 

src,dest A source or destination memory operand used in a string operation. 
immed A constant operand. 


In some cases abbreviations have numeric suffixes to specify that the operand must 
be a particular size. For example, reg/6 means that only a 16-bit (word) register is 
accepted. 


Examples 


One or more examples are shown for each syntax. Their position is not related to 
the clock speeds in the right column. 


Clock Speeds 


Column 3 shows the clock speeds for each processor. Sometimes an instruction may 
have more than one clock speed. Multiple speeds are separated by commas. If 
several speeds are part of an expression, they are enclosed in parentheses. The 
following abbreviations are used to specify variations: 


EA Effective address. This applies only to the 8088 and 8086 processors, as 
described in the next section. 


b,w,d_ Byte, word, or doubleword operands. 
pm _ Protected mode. 


n_ Iterations. Repeated instructions may have a base number of clocks plus a 
number of clocks for each iteration. For example, 8+4n means 8 clocks plus 4 
clocks for each iteration. 


noj No jump. For conditional jump instructions, noj indicates the speed if the 
condition is false and the jump is not taken. 
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m Next instruction components. Some control transfer instructions take different 
times depending on the length of the next instruction executed. On the 8088 and 
8086, m is never a factor. On the 80286, m is the number of bytes in the instruction. 
On the 80386-80486, 7 is the number of components. Each byte of encoding is a 
component, and the displacement and data are separate components. 


W88,88 8088 exceptions. See “Timings on the 8088 and 8086 Processors,” 
following. 


Clocks can be converted to nanoseconds by dividing 1 microsecond by the number 
of megahertz (MHz) at which the processor is running. For example, on a processor 
running at 8 MHz, 1 clock takes 125 nanoseconds (1000 MHz per nanosecond / 8 
MHz). 


The clock counts are for best-case timings. Actual timings vary depending on wait 
states, alignment of the instruction, the status of the prefetch queue, and other 
factors. 


Timings on the 8088 and 8086 Processors 


Because of its 8-bit data bus, the 8088 always requires two fetches to get a 16-bit 
operand. Therefore, instructions that work on 16-bit memory operands take longer 
on the 8088 than on the 8086. Separate 8088 timings are shown in parentheses 
following the main timing. For example, 9 (W&8=13) means that the 8086 with any 
operands or the 8088 with byte operands take 9 clocks, but the 8088 with word 
operands takes 13 clocks. Similarly, 16 (S8=24) means that the 8086 takes 16 
clocks, but the 8088 takes 24 clocks. 


On the 8088 and 8086, the effective address (EA) value must be added for 
instructions that operate on memory operands. A displacement is any direct memory 
or constant operand, or any combination of the two. The following shows the 
number of clocks to add for the effective address: 


Components EA Clocks Examples 
Displacement 6 mov ax,stuff 
mov ax,stuff+2 

Base or index » 5 . mov ax,[bx] 

| mov ax,[di] 
Displacement 9 mov ax,[bp+8] 
plus base or index mov ax,stuff[di] 
Base plus index (BP+DI, BX+SI) 7 mov ax,[Lbx+si] 


mov ax,[Lbptdi] 
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Components | EA Clocks Examples 
Base plus index (BP+SI, BX+DI) 8 mov ax,Lbxt+di] 

: mov ax,{bptsi] 
Base plus index plus displacement 11 mov ax,stuff[bx+si] 
(BP+DI+disp, BX+SI+disp) mov ax,[Lbptdi+8] 
Base plus index 12 mov ax,stuff[bx+di] 
plus displacement (BP+SI+disp, mov ax,[bp+sit2@] 
BX+DI+disp) 
Segment override EA+2 mov ax,es:stuff 


mov ax,ds:{bp+10] 


Timings on the 80286-80486 Processors 


On the 80286-80486 processors, the effective address calculation is handled by 
hardware and is therefore not a factor in clock calculations except in one case. If a 
memory operand includes all three possible elements—a displacement, a base 
register, and an index register—then add one clock. On the 80486, the extra clock 
is not always used. Examples are shown in the following. 


mov ax, [bx+di] _3No extra 
mov ax, array[bx+di J ;One extra 
mov ax, [bx+di+6] , :One extra 


Note 80186 and 80188 timings are different from 8088, 8086, and 80286 timings. 
They are not shown in this manual. Timings are also not shown for protected-mode 
transfers through gates or for the virtual 8086 mode available on the 80386-80486 
processors. 


Interpreting Encodings 


Encodings are shown for each variation of the instruction. This section describes 
encoding for all processors except the 80386-80486. The encodings take the form 
of boxes filled with Os and 1s for bits that are constant for the instruction variation, 
and abbreviations (in italics) for the following variable bits or bitfields: 


d_ Direction bit. If set, do memory to register; the reg field is the destination. If 
clear, do register to memory or register to register; the reg field is the source. 


a Accumulator direction bit. If set, move accumulator register to memory. If clear, 
move memory to accumulator register. 


w Word/byte bit. If set, use 16-bit or 32-bit operands. If clear, use 8-bit operands. 
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s Sign bit. If set, sign-extend 8-bit immediate data to 16 bits. 


mod Mode. This 2-bit field gives the register/memory mode with displacement. 
The possible values are shown below: 


mod Meaning 


00 This value can have two meanings: 
If r/m is 110, a direct memory operand is used. 
If r/m is not 110, the displacement is 0 and an indirect memory operand is 
used. The operand must be based, indexed, or based indexed. 


01 An indirect memory operand is used with an 8-bit displacement. 
10 An indirect memory operand is used with a 16-bit displacement. 
11 A two-register instruction is used; the reg field specifies the destination and the 


r/m field specifies the source. 


reg Register. This 3-bit field specifies one of the general-purpose registers: 


reg 16/32-bit if w=1 8-bit if w=0 
000 AX/EAX | AL 
001 CX/ECX CL 
010 | DX/EDX DL 
011 BX/EBX BL 
100 SP/ESP AH 
101 BP/EBP CH 
110 SI/ESI DH 
111 DI/EDI BH 


The reg field is sometimes used to specify encoding information rather than a 
register. 


- sreg Segment register. This field specifies one of the segment registers: 


sreg Register 
000 ES 
001 CS 
010 SS 
O11 DS 
100 FS 


101 GS 
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rim Register/memory. This 3-bit field specifies a register or memory r/m operand. 


If the mod field is 11, r/m specifies the source register using the reg field codes. 
Otherwise, the field has one of the following values: 


r/m 
000 
001 
010 
011 
100 
101 
110 
111 


Operand Address 
DS:[BX+SI+disp] 
DS:[BX+DI+disp] 
SS:[BP+SI+disp] 
SS:[BP+DI+disp] 
DS:[SI+disp] 
DS:[DI+disp] 
SS:[BP+disp]* 
DS:[BX+disp] 


* If mod is 00 and r/m is 110, then the operand is treated as a direct memory operand. This means that 
the operand [BP] is encoded as [BP+@] rather than having a short-form like other register indirect 
operands. Encoding [BX] takes one byte, but encoding [BP] takes two. 


disp Displacement. These bytes give the offset for memory operands. The 
possible lengths (in bytes) are shown in parentheses. 


data Data. These bytes give the actual value for constant values. The possible 
lengths (in bytes) are shown in parentheses. 


If a memory operand has a segment override, the entire instruction has one of the 
following bytes as a prefix: 


Prefix 

00101110 (2Eh) 
00111110 (3Eh) 
00100110 (26h) 
00110110 (36h) 
01100100 (64h) 
01100101 (65h) 


Example 


Segment 
CS 
DS 
ES 
SS 
FS 
GS 


As an example, assume you want to calculate the encoding for the following 
statement (where warray is a 16-bit variable): 


add 


warrayLbxt+tdi], -3 
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First look up the encoding for the immediate-to-memory syntax of the ADD 
instruction: 


100000sw mod,000,7/m disp (0,1, or 2) data (0, 1, or 2) 


Since the destination is a word operand, the w bit is set. The 8-bit immediate data 
must be sign-extended to 16 bits to fit into the operand, so the s bit is also set. The 
first byte of the instruction is therefore 10000011 (83h). 


Since the memory operand can be anywhere in the segment, it must have a 16-bit 
offset (displacement). Therefore the mod field is 10. The reg field is 000, as shown 
in the encoding. The 7/m coding for [bx+di+disp] is 001. The second byte is 
10000001 (81h). 


The next two bytes are the offset of warray. The low byte of the offset is stored 
first and the high byte second. For this example, assume that warray is located at 
offset 1OEFh. 


The last byte of the instruction is used to store the 8-bit immediate value —3 (FDh). 
This value is encoded as 8 bits (but sign-extended to 16 bits by the processor). 


The encoding is shown here in hexadecimal: 
83 81 EF 10 FD 


You can confirm this by assembling the instruction and looking at the resulting 
assembly listing. 


Interpreting 80386-80486 Encoding Extensions 


This book shows 80386-80486 encodings for instructions that are available only on 
the 80386-80486 processors. For other instructions, encodings are shown only for 
the 16-bit subset available on all processors. This section tells how to convert the 
80286 encodings shown in the book to 80386-80486 encodings that use extensions 
such as 32-bit registers and memory operands. 


The extended 80386-80486 encodings differ in that they can have additional prefix 
bytes, a Scaled Index Base (SIB) byte, and 32-bit displacement and immediate 
bytes. Use of these elements is closely tied to the segment word size. The use type 
of the code segment determines whether the instructions are processed in 32-bit 
mode (USE32) or 16-bit mode (USE16). Current versions of MS-DOS@ and. 
Microsofte Windows™ use 16-bit mode only. Windows NT uses 32-bit mode. 


The bytes that can appear in an instruction encoding are: 
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16-Bit Encoding 


Opcode mod-reg-r/m disp _ - immed 
(1-2) (0-1) (0-2) (0-2) 


32-Bit Encoding 


Address- Scaled 


Size Operand- mod-reg- Index 
(67h). - Size (66h) Opcode = r/m Base disp immed 
(0-1) (0-1) (1-2) (0-1) (0-1) (0-4) (0-4) 


Additional bytes may be added for a segment prefix, a repeat eee or the LOCK 
prefix. 


Address-Size Prefix 


The address-size prefix determines the segment word size of the operation. It can 
override the default size for calculating the displacement of memory addresses. The 
address prefix byte is 67h. The assembler auemaneay. inserts this byte where 
appropriate. 


In 32-bit mode (USE32 or FLAT code segment), displacements are calculated as 
32-bit addresses. The effective address-size prefix must be used for any instructions 
that must calculate addresses as 16-bit displacements. In 16-bit mode, the defaults 
are reversed. The prefix must be used to specify calculation of 32-bit 

displacements. 


Operand-Size Prefix 


The operand-size prefix determines the size of operands. It can override the default . 
size of registers or memory operands. The operand-size prefix byte is 66h. The 
assembler automatically inserts this byte where appropriate. 


In 32-bit mode, the default sizes for operands are.8 bits and 32 bits (depending on 
the w bit). For most instructions, the operand-size prefix must be used for any 
instructions that use 16-bit operands. In 16-bit mode, the default sizes are 8 bits and 
16 bits. The prefix must be used for any instructions that use 32-bit operands. Some 
instructions use 16-bit operands, regardless of mode. 


Encoding Differences for 32-Bit Operations 


When 32-bit operations are performed, the meaning of certain bits or fields is 
different from their meaning in 16-bit operations. The changes may affect default 
operations in 32-bit mode, or 16-bit mode operations in which the address-size 
prefix or the operand-size prefix is used. The following fields may have a different 
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meaning for 32-bit operations from their meaning as described in the “Interpreting 
Encodings” section: 

w Word/byte bit. If set, use 32-bit operands. If clear, use 8-bit operands. 
s Sign bit. If set, sign-extend 8-bit and 16-bit immediate data to 32 bits. 


mod Mode. This field indicates the register/memory mode. The value 11 still 
indicates a register-to-register operation with 7/m containing the code for a 32-bit 
source register. However, other codes have different meanings as shown in the 
tables in the next section. 


reg Register. The codes for 16-bit registers are extended to 32-bit registers. For 
example, if the reg field is O00, EAX is used instead of AX. Use of 8-bit registers 
is unchanged. 


sreg Segment register. The 80386 has the following additional segment registers: 


sreg Register 
100 FS 
101 . GS 


rim Register/memory. If the 7/m field is used for the source register, 32-bit 
registers are used as for the reg field. If the field is used for memory operands, the 
meaning is completely different from the meaning used for 16-bit operations, as 
shown in the tables in the next section. 


disp Displacement. This field is 4 bytes for 32-bit addresses. 


data Data. Immediate data can be up to 4 bytes. 


Scaled Index Base Byte 


Many 80386-80486 extended memory operands are too complex to be represented 
by a single mod-reg-r/m byte. For these operands, a value of 100 in the 7/m field 
signals the presence of a second encoding byte called the Scaled Index Base (SIB) 
byte. The SIB byte is made up of the following fields: 


ss index base 


ss Scaling Field. This two-bit field specifies one of the following scaling factors: 


SS Scale 
00 . 1 
01 


2 
10 4 
11 8 


62 Reference 


index Index Register. This three-bit field specifies one of the following index 


registers: 

index Register 
000 EAX 

001 ECX 
010 EDX 
011 EBX 

100 no index 
101 EBP 

110 ESI 

111 EDI 


Note ESP cannot be an index register. If the index field is 100, the ss field 
must be 00. 


base Base Register. This 3-bit field combines with the mod field to specify the 
base register and the displacement. Note that the base field only specifies the base 
when the 7/m field is 100. Otherwise, the r/m field specifies the base. 


The possible combinations of the mod, r/m, scale, index, and base fields are as 


follows: 

Fields for 32-Bit Fields for 32-Bit 

Nonindexed Operands Indexed Operands 

mod rim  Operand mod rim base Operand 

00 000 ODS:(CEAX] @@ 100 000 DS:(EAX+(scale*index)] 

@0 001 OS:LECX] 00 100 001 DS:[ECX+(scale*index)] 

@0 010 DS:(CEDX] @0 100 010 ODS:[EDX+(scale*index))} 

00 11 OS:[EBX] @@ 100 @11 DS:[EBX+(scale*index)] 

@@ 100 SIB used ——————->( 00 100 100 SS:[ESP+(scale*index)] 

Q@@ 101 DS:disp32+ 00 100 101 DS: (disp32+(scale*index)]+ 

@0@ 110 OS:[CEST] @@ 100 110 DS:[ESI1+(scale*index)] 

@@ 111 ODS:CEDI) @@ 100 111 DS:CEDI+(scale*index)] 

@1 000 DS:[EAX+disp8] Q@1 100 000 OS:[EAX+(scale*index)+disp8] 
@1 @01 DS:LECX+disp8] @1 100 001 DS:[ECX+(scale*index)+disp8] 
@1 010 DS:(EDX+disp8] @1 100 @1@ DS: [EDX+/(scale*index)+disp8] 
01 @11 ODS:LEBX+disp8] 61 100 11 ODS: [EBX+(scale*index)+disp8] 
01 100 SIB used ———————»>( 01 100 100 SS:[ESP+/(scale*index)+disp8 ] 
@1 101 SS:[EBP+disp8] Q@1 100 101 SS:[EBP+/(scale*index)+disp8] 
01 110 DS:CESI+disp8] @1 100 110 ODS:([ESI+(scale*index)+disp8] 
@1 111 DS: LEDI+disp8) @1 100 111 DS:{EDI+(scale*index)+disp8] 
10 000 DS: [EAX+disp32] 10 100 000 DS:[EAX+/(scale*index)+disp32] 
1@ 001 DS:CECX+disp32] 10 100 001 ODS:[ECX+(scale*index)+disp32] 
10 010 ODS: [EDX+disp32] 10 100 010 DS:(EDX+(scale*index)+disp32] 
10 @11 DS:[EBX+disp32] 10 100 011 DS:[EBX+(scale*index)+disp32 
10 100 SIB used ——————-»>( 1@ 100 100 SS:[ESP+/(scale*index)+disp32 ] 
1@ 101 SS: [EBP+disp32] 1@ 100 101 SS: (EBP+/(scale*index)+disp32] 
1@ 010 DS:[ESI+disp32] 10 100 110 DS:[ESI+(scale*index)+disp32] 
1@ 111 DS:[EDI+disp32] 1@ 10@ 111 DS:[EDI+(scale*index)+disp32] 


+ The operand [EPB] must be encoded as [EPB+@] (the 0 is an 8-bit displacement). 
Similarly, [EBP+(scale*index)] must be encoded as [EBP+(scale*index)+0 ]. The 
short encoding form available with other base registers cannot be used with EBP. 
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If a memory operand has a segment override, the entire instruction has one of the 
prefixes discussed in the preceding section, “Interpreting Encodings,” or one of the 
following prefixes for the segment registers available only on the 80386-80486: 


Prefix | Segment 
01100100 (64h) FS 
01100101 (65h) GS 
Example 


Assume you want to calculate the encoding for the following statement (where 
warray is a 16-bit variable). Assume that the instruction is used in 16-bit mode. 


add warray[eaxtecx*2], -3 


First look up the encoding for the immediate-to-memory syntax of the ADD 
instruction: 


100000sw mod,000,r/m disp (0,1, o0r2) data (1 or 2) 


This encoding must be expanded to account for 80386-80486 extensions. Note that 
the instruction operates on 16-bit data in a 16-bit mode program. Therefore, the 
operand-size prefix is not needed. However, the instruction does use 32-bit registers 
to calculate a 32-bit effective address. Thus the first byte of the encoding must be 
the effective address-size prefix, 01100111 (67h). 


The opcode byte is the same (83h) as for the 80286 example described in the 
“Interpreting Encodings” section. 


The mod-reg-r/m byte must specify a based indexed operand with a scaling factor 
of two. This operand cannot be specified with a single byte, so the encoding must 
also use the SIB byte. The value 100 in the 7/m field specifies an SIB byte. The reg 
field is 000, as shown in the encoding. The mod field is 10 for operands that have 
base and scaled index registers and a 32-bit displacement. The combined mod, reg, 
and r/m fields for the second byte are 10000100 (84h). 


The SIB byte is next. The scaling factor is 2, so the ss field is 01. The index register 
is ECX, so the index field is 001. The base register is EAX, so the base field is 000. 
The SIB byte is 01001000 (48h). 


The next 4 bytes are the offset of warray. The low bytes are stored first. For this 
example, assume that warray is located at offset 1OEFh. This offset only requires 
2 bytes, but 4 must be supplied because of the addressing mode. A 32-bit address 
can be safely used in 16-bit mode as long as the upper word is 0. 


The last byte of the instruction is used to store the 8-bit immediate value —3 (FDh). 
The encoding is shown here in hexadecimal: 


67 83 84 48 00 00 EF 10 FD 


64 AAA ASCII Adjust After Addition 


Instructions 


This section provides an alphabetical reference to the instructions for the 8086, 
8088, 80286, 80386, and 80486 processors. 


AAA ASCII Adjust After Addition 


Adjusts the result of an addition to a decimal digit (0-9). The previous addition 
instruction should place its 8-bit sum in AL. If the sum is greater than 9h, AH is 
incremented and the carry and auxiliary carry flags are set. Otherwise, the carry 
and auxiliary carry flags are cleared. 


Flags ODITSZAPC 
: 2 | aes ames es 
Encoding 00110111 
Syntax Examples CPU = Clock Cycles 
AAA aaa 88/86 = 8 
286 3 
386 4 
486 3 


AAD ASCII Adjust Before Division 


Converts unpacked BCD digits in AH (most significant digit) and AL (least 
significant digit) to a binary number in AX. This instruction is often used to prepare 
an unpacked BCD number in AX for division by an unpacked BCD digit in an 8-bit 


register. 
Flags ODITS ZAPC 
rs a a ae aaa 
Encoding 11010101 00001010 
Syntax Examples CPU Clock Cycles 
AAD aad 88/86 60 
286 14 
386 19 


486 14 


AAS ASCII Adjust After Subtraction 65 


AAM ASCII Adjust After Multiply 


Flags 


Encoding 


Converts an 8-bit binary number less than 100 decimal in AL to an unpacked BCD 
number in AX. The most significant digit goes in AH and the least significant in 
AL. This instruction is often used to adjust the product after a MUL instruction that 
multiplies unpacked BCD digits in AH and AL. It is also used to adjust the quotient 
after a DIV instruction that divides a binary number less than 100 decimal in AX 
by an unpacked BCD number. 


ODITSZAPC 
9 ee ee 


11010100 00001010 


Syntax Examples CPU = _ Clock Cycles 
AAM aam 88/86 83 
. 286 16 
386 17 
486 15 


AAS ASCII Adjust After Subtraction 


Flags 


Encoding 


- Adjusts the result of a subtraction to a decimal digit (0-9). The previous subtraction 


instruction should place its 8-bit result in AL. If the result is greater than 9h, AH is 
decremented and the carry and auxiliary carry flags are set. Otherwise, the carry 
and auxiliary carry flags are cleared. 


ODI TS ZAPC 


? PO ae ae 
00111111 
Syntax Examples . CPU Clock Cycles 
AAS aas 88/86 8 
. 286 3 
386 4 
3 


486 


66 ADC Add with Carry 


ADC Add with Carry 


Flags 


Encoding 


Encoding 


Encoding 


Adds the source operand, the destination operand, and the value of the carry flag. 
The result is assigned to the destination operand. This instruction is used to add the 
more significant portions of numbers that must be added in multiple registers. 


ODI TSZAPC 
+ a ae A A 


000100dw mod,reg,r/m disp (0, 1, or 2) 


Syntax Examples CPU Clock Cycles 
ADC reg,reg adc dx,cx 88/86 3 
286 2 
386 2 
486 1 
ADC mem,reg adc WORD PTR m32[2],dx 88/86 16+EA (W88=24+EA) 
286 7 
386 7 
486 =) 
ADC reg,mem adc dx,WORD PTR m32[2] 88/86 9+EA (W88=13+EA) 
286 d. 
386 6 
486 2 


100000sw mod,010,rim_ disp (0,1,or2) data (I or 2) 


Syntax Examples CPU = Clock Cycles 
ADC reg,immed adc dx,12 88/86 4 
: 286 3 
386 2 
486 1 
ADC mem,immed adc WORD PTR m32[2],16 88/86 17+EA (W&8=23+EA) 
286 7 
386 7 
486 3 


0001010w data(J or2) 


Syntax Examples CPU = Clock Cycles 
ADC accum,immed adc ax,5 88/86 4 

286 3 

386 2 

486 1 


ADD 


Flags 


Encoding 


Encoding 


Encoding 


Add 


ADD Add 67 


Adds the source and destination operands and puts the sum in the destination 


operand. 


ODI TSZAPC 
Se a ee 


000000dw = mod,reg,r/m_ disp (0, 1, or 2) 


Syntax Examples 
ADD reg,reg add ax,bx 
ADD mem, reg | add total, cx 


add array[bx+di], dx 


ADD reg,mem add cx,incer 
add dx,[bp+6] 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


100000sw mod, 000,r/m_ disp (p,1, or2) data (lor2) 


Syntax Examples 


ADD reg,immed add bx,6 


ADD mem,immed add amount,27 
add pointers[bx][si],6 


0000010w data (I or 2) 


Syntax Examples 


ADD accum,immed add ax,10 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


3 
2 
2 
1 


16+EA (W88=24+EA) 
vi 
7 
3 


9+EA (W88=13+EA) 
‘i 
6 
2 


Clock Cycles 


4 
3 
2 
1 


17+EA (W88=23+EA) 
7 
7 
3 


Clock Cycles 


4 
3 
2 
1 


68 AND Logical AND 


AND Logical AND. 


Performs a bitwise AND operation on the source and destination operands and 
stores the result in the destination operand. For each bit position in the operands, if 
both bits are set, the corresponding bit of the result is set. Otherwise, the 
corresponding bit of the result is cleared. 


ODITSZAPC 
0 S Aeb Poe 0 


Flags 


Encoding 


Encoding 


Encoding — 


001000dw mod,reg,r/m 


disp (0, 1, or 2) 


Syntax Examples 
AND reg,reg and dx,bx 
AND mem,reg and bitmask,bx 
and [bp+2],dx 
AND reg,mem and bx,masker 
and dx,marray[bx+di] 


100000sw mod,100,r/m_ disp (0,1,or2) data (1 or 2) 


Syntax Examples 


AND reg,immed and 


AND mem,immed and 


0010010w data (J or 2) 


dx,QF7h 


masker, 10@1b 


Syntax Examples 


AND accum,immed and 


ax, @B6h 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


CPU 


88/86 
286 . 
386 
486 


Clock Cycles 


=} 
2 
2 
l 


16+EA (W88=24+EA) 
7 
7 
3 


9+EA (W88=13+EA) 
7 
6 
2 


Clock Cycles 


4 
3 
2 
1 


17+EA(W88=24+EA) 
7 
7 
3 


Clock Cycles 


4 
3 
2 
1 


BOUND Check Array Bounds 69 


ARPL Adjust Requested Privilege Level 


Flags 


Encoding 


80286-80486 Protected Only Verifies that the destination Requested Privilege 
Level (RPL) field (bits 0 and 1 of a selector value) is less than the source RPL 
field. If it is not, ARPL adjusts the destination RPL to match the source RPL. The 
destination operand should be a 16-bit memory or register operand containing the 
value of a selector. The source operand should be a 16-bit register containing the 
test value. The zero flag is set if the destination is adjusted; otherwise, the flag is 
cleared. ARPL is useful only in 80286-80486 protected mode. See Intel 
documentation for details on selectors and privilege levels. 


ODI TS ZAPC 
+ 


01100011 mod,reg,rim disp (0, 1, or 2) 


Syntax Examples CPU Clock Cycles 
ARPL reg,reg arpl ax,cx 88/86 — 
286 10 
386 20 
486 9 
ARPL mem,reg arp] selector,dx 88/86 — 
286 11 
386 2 
486 9 


BOUND Check Array Bounds 


Flags 


80286-80486 Only Verifies that a signed index value is within the bounds of an 
array. The destination operand can be any 16-bit register containing the index to be 
checked. The source operand must then be a 32-bit memory operand in which the 
low and high words contain the starting and ending values, respectively, of the 
array. (On the 80386-80486 processors, the destination operand can be a 32-bit 
register; in this case, the source operand must be a 64-bit operand made up of 32-bit 
bounds.) If the source operand is less than the first bound or greater than the last 
bound, an interrupt 5 is generated. The instruction pointer pushed by the interrupt 
(and returned by IRET) points to the BOUND instruction rather than to the next 
instruction. | 


No change 


70 BSF/BSR Bit Scan 


Encoding 01100010 mod,reg,r/m disp (2) 
Syntax Examples CPU Clock Cycles 
BOUND reg]6,mem32 bound di,base-4 88/86 — 
BOUND reg32,mem64* 286 noj=13t 
386 noj=10F 
486 noj=7 


* 80386-80486 only. 
+ See INT for timings if interrupt 5 is called. 


BSF/BSR Bit Scan 


80386-80486 Only Scans an operand to find the first set bit. If a set bit is found, 
the zero flag is cleared and the destination operand is loaded with the bit index of 
the first set bit encountered. If no set bit is found, the zero flag is set. BSF (Bit Scan 
Forward) scans from bit 0 to the most significant bit. BSR (Bit Scan Reverse) scans 
from the most significant bit of an operand to bit 0. 


Flags ODI TS ZAPC 
as 
Encoding 00001111 10111100 mod,reg,r/m_ disp (0, 1,2, or 4) 
Syntax Examples CPU = Clock Cycles 
BSF regl6,regl6 St cx. bx 88/86 — 
BSF reg32,reg32 286 — 
386 10+3n* 
486 642+ 
BSF regl6,meml6 ~—bsf = ecx, bitmask 88/86 — 
BSF reg32,mem32 286 — 
386 10+3n* 


486 7-438 


Encoding 


BSWAP Byte Swap 71 


00001111 10111101 mod,reg,r/m_ disp (0, 1,2, or 4) 


Syntax Examples CPU Clock Cycles 
BSR regl6,reg16 bsr cx,dx 88/86 — 
BSR reg32,reg32 286 — 


386 10+3n* 
486 103 — 3n# 


BSR regl6,meml6 = bsr_ eax, bitmask 88/86 — 

BSR _ reg32,mem32 286 —_— 
386 10+3n* 
486 104 — 3n# 


* n = bit position from 0 to 31. 
clocks = 6 if second operand equals 0. 


+ Clocks = 8 + 
4 for each byte scanned + 
3 for each nibble scanned + 
3 for each bit scanned in last nibble 
or 6 if second operand equals 0. 


§ Same as footnote above, but add 1 clock. 


# n = bit position from 0 to 31. 
clocks = 7 if second operand equals 0. 


BSWAP Byte Swap 


Flags 


Encoding 


80486 Only Takes a single 32-bit register as operand and exchanges the first byte 
with the fourth, and the second byte with the third. This instruction does not alter 
any bit values within the bytes and is useful for quickly translating between 8086-. 
family byte storage and storage schemes in which the high byte is stored first. 


No change 
00001111 11001 reg 


Syntax Examples CPU Clock Cycles 
BSWAP reg32 bswap eax 88/86 — 
bswap ebx 286 — 
386 — 


aN 
[o,e) 
ON 
— 


72 BT/BTC/BTR/BTS Bit Tests 


BT/BTC/BTR/BTS Bit Tests" 


80386-80486 Only Copies the value of a specified bit into the carry flag, where it 
can be tested by a JC or JNC instruction. The destination operand specifies the 
value in which the bit is located; the source operand specifies the bit position. BT 
simply copies the bit to the flag. BTC copies the bit and complements (toggles) it in 
the destination. BTR copies the bit and resets (clears) it in the destination. BTS 
copies the bit and sets it in the destination. 


Flags ODI TS ZAPC 
Encoding 00001111 10111010 mod, BBB*,rim disp (0,1,2,o0r4) data(1) 
Syntax Examples CPU Clock Cycles 
BT reg16,immed8+ bt ax,4 88/86 — 
286 — 
386 3 
486 3 
BTC regl6,immed8+} bts ax,4 88/86 — 
BTR reg]6,immed8t btr  bx,17 286 — 
BTS reg/6,immed8+ btc edi,4 386 6 
486 6 
BT mem16,immed8+ btr DWORD PTR 88/86 — 
[si],27 286 — 
btc color{di],4 386 6 
486 3 
_ BTC mem16,immed8+ btc DWORD PTR 88/86 = — 
BTR mem16,immed8+ [bx],27 286 — 
BTS mem16,immed8+ btc. maskit,4 386 8 
btr color{di],4 486 8 
Encoding 00001111 10BBBO11* mod,reg,r/m_ disp (0,1, 2, or 4) 
Syntax Examples CPU Clock Cycles 
BT regl6,reg16+ bt  ax,bx 88/86 — 
286 — 
386 3 
. 486 3 
BTC regl6,regl6+ btc eax,ebx 88/86 — 
BTR reg/6,reg16+ bts bx,ax 286 — 
BTS regl6,regl6+ btr cx,di 386 6 
486 6 


CALL Call Procedure 


Flags 


Encoding 


Encoding 


Syntax 
BT meml6,reg]l6t 


BTC meml6,reg16+ 
BTR meml16,regl6+ 
BTS mem16,reg16+ 


Examples 


bt [bx],dx 


bts flags[bx],cx 
btr rotate,cx 
btc [bpt+8],si 


CALL Call Procedure 73 


* BBB is 100 for BT, 111 for BTC, 110 for BTR, and 101 for BTS. 
+ Operands also can be 32 bits (reg32 and mem32). 


Clock Cycles 


Calls a procedure. The instruction pushes the address of the next instruction onto 
the stack and jumps to the address specified by the operand. For NEAR calls, the 
offset (IP) is pushed and the new offset is loaded into IP. 


For FAR calls, the segment (CS) is pushed and the new segment is loaded into CS. 
Then the offset (IP) is pushed and the new offset is loaded into IP. A subsequent 
RET instruction can pop the address so that execution continues with the , 
instruction following the call. 


No change 
11101000 disp (2) 


Syntax 
CALL label 


10011010 disp (4) 


Syntax 
CALL label 


Examples 


call upcase 


Examples 


call FAR PTR job 
call distant 


CPU 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


19 (88=23) 
7+m 

7+m 

3 


Clock Cycles 


28 (88=36) 
13+m,pm=26+m* 
17+m,pm=34+m* 
18,pm=20* 


74 CBW Convert Byte to Word 


Encoding 11111111 mod,010,r/m 
Syntax Examples CPU 
CALL reg call ax 88/86 
286 
386 
486 
CALL meml6 call pointer 88/86 
CALL mem32+ call [bx] . 286 
386 
486 
Encoding 11111111 mod,011,r/m 
Syntax Examples CPU 
CALL mem32 call. far_table[di] 88/86 
’ CALL mem48+ call DWORD PTR [bx] 286 
386 
486 


Clock Cycles 


16 (S8=20) 
7+m 

7+m 

5 


21+EA (88=29+EA) 


11l+m 
10+m 
5 


Clock Cycles 
37+EA (88=53+EA) 


16+m,pm=29+m* 
22+m,pm=38+m* 
17,pm=20* 


* Timings for calls through call and task gates are not shown, since they are used primarily in 


operating systems. 
+ 80386-80486 32-bit addressing mode only. 


CBW Convert Byte to Word 


Converts a signed byte in AL to a signed word in AX by extending the sign bit 0 


AL into all bits of AH. 
Flags No change 
Encoding 10011000* , 
Syntax Examples CPU = Clock Cycles 
CBW cbw 88/86 
286 
386 
486 


* CBW and CWDE have the same encoding with two exceptions: in 32-bit mode, CBW is preceded by 
the operand-size byte (66h) but CWDE is not; in 16-bit mode, CWDE is preceded by the operand- 


size byte but CBW is not. 


CLC Clear Carry Flag 75 


CDQ _ Convert Double to Quad 


80386-80486 Only Converts the signed doubleword in EAX to a signed quadword 
in the EDX:EAX register pair by extending the sign bit of EAX into all bits of 


EDX. 
Flags No change 
Encoding 10011001* 
Syntax Examples CPU Clock Cycles 
CDQ cdq 88/86 — 
286 — 
386 2 
486 3 


* CWD and CDQ have the same encoding with two exceptions: in 32-bit mode, CWD is preceded by 
the operand-size byte (66h) but CDQ is not; in 16-bit mode, CDQ is preceded by the operand-size 
byte but CWD is not. 


CLC Clear Carry Flag 


Clears the carry flag. 
Flags ODITSZAPC 
0 
Encoding 11111000 
Syntax Examples CPU = Clock Cycles 
CLC elt 88/86 2 
286 2 
386 2 
486 2 


76 CLD Clear Direction Flag 


CLD Clear Direction Flag 


Clears the direction flag. All subsequent string instructions will process up (from 
low addresses to high addresses) by increasing the appropriate index registers. 


Flags ODITS ZAPC 
. 0 
Encoding 11111100 
Syntax Examples CPU Clock Cycles 
CLD cld 88/86 2 
286 2 
386 2 
486 2 


CLI Clear Interrupt Flag 


Clears the interrupt flag. When the interrupt flag is cleared, maskable interrupts are 
not recognized until the flag is set again with the STI instruction. In protected 
mode, CLI clears the flag only if the current task’s privilege level is less than or 
equal to the value of the IOPL flag. Otherwise, a general-protection fault occurs. 


Flags ODITS ZAPC 
0 
Encoding 11111010 
Syntax Examples CPU Clock Cycles 
CLI cli a 88/86 2 
286 3 
386 3 
486 5 


CLTS Clear Task-Switched Flag 


80286-80486 Privileged Only Clears the task-switched flag in the Machine Status 
Word (MSW) of the 80286, or the CRO register of the 80386-80486. This 
instruction can be used only in system software executing at privilege level 0. See 


CMP Compare Two Operands 77 


Intel documentation for details on the task-switched flag and other privileged-mode 


concepts. 
Flags No change 
Encoding 00001111 00000110 
Syntax Examples CPU Clock Cycles 
CLTS clts 88/86 — 
286 2 
386 5 
486 a 
CMC Complement Carry Flag 
Complements (toggles) the carry flag. 
Flags ODITS ZAPC 
a 
Encoding 11110101 
Syntax Examples CPU = Clock Cycles ~ 
CMC . cmc 88/86 2 
286 2 
386 2 
486 Z 


CMP Compare Two Operands 


Compares two operands as a test for a subsequent conditional-jump or set 
instruction. CMP does this by subtracting the source operand from the destination 
operand and setting the flags according to the result. CMP is the same as the SUB 
instruction, except that the result is not stored. 


Flags ODITS ZAPC 


78 CMP Compare Two Operands 


Encoding 


Encoding 


Encoding 


001110dw mod, reg, rim disp (0, 1, or 2) 


Syntax 
CMP reg,reg 


CMP mem,reg 


CMP reg,mem 


100000sw mod, 111,r/m 


Syntax 


CMP reg,immed 


CMP mem,immed 


0011110w data (I or 2) 


Syntax 


CMP accum,immed 


Examples 


cmp 
cmp 


cmp 
cmp 


cmp 
cmp 


di,bx 
dil,cl 


maximum, dx 


array[si],bl 


dx ,minimum 
bh,arrayfsi] 


disp (0,1, or2) data (I or 2) 


Examples 


cmp 


cmp WORD PTR [di],4 


cmp 


bx,24 


tester, 4000 


Examples 


cmp 


ax,1000 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


3 
2 
Z 
I 


9+EA 
(W88=13+EA) 
7 

5 

2 


9+FA 
(W88=13+EA) 
6 

6 

2 


Clock Cycles 


4 
3 
Z 
1 


10+EA 
(W88=14+EA) 
6 

5 

2 


Clock Cycles 


4 
S 
2 
1 


CMPS/CMPSB/CMPSW/CMPSD Compare String 79 


CMPS/CMPSB/CMPSW/CMPSD Compare String © 


Compares two strings. DS:SI must point to the source string and ES:DI must point 
to the destination string (even if operands are given). For each comparison, the 
destination element is subtracted from the source element and the flags are updated 
to reflect the result (although the result is not stored). DI and SI are adjusted 
according to the size of the operands and the status of the direction flag. They are 
increased if the direction flag has been cleared with CLD, or decreased if the 
direction flag has been set with STD. 


If the CMPS form of the instruction is used, operands must be provided to indicate 
the size of the data elements to be processed. A segment override can be given for 
the source (but not for the destination). If CMPSB (bytes), CMPSW (words), or 
CMPSD (doublewords on the 80386-80486 only) is used, the instruction 
determines the size of the data elements to be processed. 


CMPS and its variations are normally used with repeat prefixes. REPNE (or 
REPNZ,) is used to find the first match between two strings. REPE (or REPZ) is 
used to find the first mismatch. Before the comparison, CX should contain the 
maximum number of elements to compare. After a REPNE CMPS, the zero flag is 
clear if no match was found. After a REPE CMPS, the zero flag is set if no 
mismatch was found. 


When the instruction finishes, ES:DI and DS:SI point to the element that follows (if 
the direction flag is clear) or precedes (if the direction flag is set) the match or 
mismatch. If CX decrements to 0, ES:DI and DS:SI point to the element that 
follows or precedes the last comparison. The zero flag is set or clear according to 
the result of the last comparison, not according to the value of CX. 


Flags ODI TS ZAPC 

+ eas Panes a Cas 
Encoding 1010011w 
Syntax Examples CPU Clock Cycles 
CMPS [[segreg:]] src, [TES:]] dest cmps  source,es:dest 88/86 22 (W&8=30) 
CMPSB [[[[segreg:[[ src, JES:]] dest] repne cmpsw 286 8 
CMPSW [[[segreg:[ src, JES:] dest] repe  cmpsb 386 10 


CMPSD [[[segreg:[ src, JES:]] dest] repne cmpsd 486 8 


80 CMPXCHG Compare and Exchange 


‘CMPXCHG Compare and Exchange 


80486 Only Compares the destination operand to the accumulator (AL, AX, or 
EAX). If equal, the source operand is copied to the destination. Otherwise, the 
destination is copied to the accumulator. The instruction sets flags according to the 
result of the comparison. 


Flags ODI TS ZAPC 
+ 2 ee A a 2 
Encoding 00001111 1011000b mod,reg,r/m_ disp (0,1, or 2) 
Syntax . Examples CPU Clock Cycles 
CMPXCHG mem,reg cmpxchg warr[bx],cx 88/86 — 
cmpxchg  string,bl 286 — 
386 — 
486 7-10 
CMPXCHG reg,reg cmpxchg dl,cl 88/86 — 
cmpxchg bx,dx 286 — 
386 — 
486 6 


CWD Convert Word to Double 


Converts the signed word in AX to a signed doubleword in the DX:AX register pair 
by extending the sign bit of AX into all bits of DX. 


Flags ODITS ZAPC 
+ a ag a 
Encoding 10011001* 
Syntax Examples. CPU = Clock Cycles 
CWD cwd 88/86 5 
. 286 2 
386 2 
486 3 


* CWD and CDQ have the same encoding with two exceptions: in 32-bit mode, CWD is preceded by 
the operand-size byte (66h) but CDQ is not; in 16-bit mode, CDQ is preceded by the operand-size 
byte but CWD is not. 


DAA Decimal Adjust After Addition 81 


CWDE Convert Word to Extended Double 


Flags 


Encoding 


80386-80486 Only Converts a signed word in AX to a signed doubleword in EAX 
by extending the sign bit of AX into all bits of EAX. 


No change 
10011000* 
Syntax Examples CPU — Clock Cycles 
CWDE cwde 88/86  — 
286 — 
386 3 
486 3 


* CBW and CWDE have the same encoding with two exceptions: in 32-bit mode, CBW is preceded 
by the operand-size byte (66h) but CWDE is not; in 16-bit mode, CWDE is preceded by the 
operand-size byte but CBW is not. 


DAA Decimal Adjust After Addition 


Flags 


Encoding 


Adjusts the result of an addition to a packed BCD number (less than 100 decimal). 
The previous addition instruction should place its 8-bit binary sum in AL. DAA 
converts this binary sum to packed BCD format with the least significant decimal 
digit in the lower four bits and the most significant digit in the upper four bits. If the 
sum is greater than 99h after adjustment, the carry and auxiliary carry flags are set. 
Otherwise, the carry and auxiliary carry flags are cleared. 


ODITSZAPC 


L ce A a ea 
00100111 
Syntax Examples CPU = Clock Cycles 
DAA daa 88/86 4 
286 3 
386 4 
2 


486 


82 DAS Decimal Adjust After Subtraction 


DAS Decimal Adjust After Subtraction 


Flags 


-Encoding 


Adjusts the result of a subtraction to a packed BCD number (less than 100 
decimal). The previous subtraction instruction should place its 8-bit binary result in 
AL. DAS converts this binary sum to packed BCD format with the least significant 
decimal digit in the lower four bits and the most significant digit in the upper four 
bits. If the sum is greater than 99h after adjustment, the carry and auxiliary carry 
flags are set. Otherwise, the carry and auxiliary carry flags are cleared. 


ODITS ZAPC 


? Se oe as a 
00101111 
Syntax Examples CPU Clock Cycles 
DAS das . 88/86 4 
286 3 
386 4 
486 2 


DEC Decrement 


Flags 


Encoding 


Subtracts 1 from the destination operand. Because the operand is treated as an 
unsigned integer, the DEC instruction does not affect the carry flag. To detect any 
effects on the carry flag, use the SUB instruction. 


ODITSZAPC 
+ ++ 4 4 


1111111w mod,001,r/m_— disp (0, 1, or 2) 


Syntax Examples CPU Clock Cycles 
DEC reg8 dec cl . 88/86 3 
. 286 2: 
386 2 
486 1 
DEC mem dec counter 88/86 15+EA (W88=23+EA) 
286 7 
386 6 


486 3 


DIV Unsigned Divide 83 


Encoding © 01001 reg 
Syntax . Examples CPU = Clock Cycles 
DEC regl6 dec ax 88/86 3 
DEC reg32* 286 Z 
386 2 
486 1 


* 80386-80486 only. 


DIV Unsigned Divide 


Divides an implied destination operand by a specified source operand. Both 
operands are treated as unsigned numbers. If the source (divisor) is 16 bits wide, 
the implied destination (dividend) is the DX:AX register pair. The quotient goes 
into AX and the remainder into DX. If the source is 8 bits wide, the implied 
destination operand is AX. The quotient goes into AL and the remainder into AH. 
On the 80386-80486, if the source is EAX, the quotient goes into EAX and the 
remainder into EDX. 


Flags ODI TS ZAP C. 
? ; aes anes as am 
Encoding 1111011w mod, 110,r/m_ disp (0, 1, or 2) 
Syntax Examples CPU = Clock Cycles 
DIV reg div cx 88/86 b=80-90,w=144—-162 
div dl 286 b=14,w=22 
386 b=14,w=22,d=38 
486 b=16,w=24,d=40 
DIV mem div [bx] 88/86 (b=86-96,w=150-168) 
div fsize +EA* 


286 b=17,w=25 
386 b=17,w=25,d=41 
486 b=16,w=24,d=40 


* Word memory operands on the 8088 take (158-176)+EA clocks. 


84 ENTER Make Stack Frame 


ENTER Make Stack Frame 


80286-80486 Only Creates a stack frame for a procedure that receives parameters 
passed on the stack. When immed16 is 0, ENTER is equivalent to push bp, 
followed by mov bp,sp. The first operand of the ENTER instruction specifies the 
number of bytes to reserve for local variables. The second operand specifies the 
nesting level for the procedure. The nesting level should be 0 for languages that do | 
not allow access to local variables of higher-level procedures (such as C, Basic, and 
FORTRAN). See the complementary instruction LEAVE for a method of exiting 


from a procedure. 


Flags No change 


Encoding 11001000 data(2) data(1) 
Syntax Examples 
ENTER immed16,0 enter 4,0 
ENTER immed16,1 enter 0,1 


ENTER immedl6,immed8 — enter 6,4 


HLT Halt 


Clock Cycles 


124+4(n — 1) 
15+4(n— 1) 
17+3n 


Stops CPU execution until an interrupt restarts execution at the instruction 
- following HLT. In protected mode, this instruction works only in privileged mode. 


Flags No change 

Encoding 11110100 
Syntax | Examples 
HLT hit 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


2 
2 
5 
4 


IMUL Signed Multiply 85 


IDIV Signed Divide 


Flags 


Encoding 


Divides an implied destination operand by a specified source operand. Both 
operands are treated as signed numbers. If the source (divisor) is 16 bits wide, the 
implied destination (dividend) is the DX:AX register pair. The quotient goes into 
AX and the remainder into DX. If the source is 8 bits wide, the implied destination 
is AX. The quotient goes into AL and the remainder into AH. On the 80386-80486, 
if the source is EAX, the quotient goes into EAX and the remainder into EDX. 


ODI TS ZAPC 
? ; came ie me 


1111011w mod, 111,r/m_ disp (0, 1, or 2) 


Syntax Examples CPU = _ Clock Cycles 
IDIV reg idiv bx 88/86 b=101-112,w= 
idiv dl 165-184 


286 b=17,w=25 
386 b=19,w=27,d=43 
486 b=19,w=27,d=43 


IDIV mem idiv itemp 88/86 (b=107-118,w=171- 
190)+EA* 
286 b=20,w=28 
386 b=22,w=30,d=46 
486 b=20,w=28,d=44 


* Word memory operands on the 8088 take (175—194)+EA clocks. 


IMUL Signed Multiply 


Multiplies an implied destination operand by a specified source operand. Both 
operands are treated as signed numbers. If a single 16-bit operand is given, the 
implied destination is AX and the product goes into the DX:AX register pair. If a 
single 8-bit operand is given, the implied destination is AL and the product goes 
into AX. On the 80386-80486, if the operand is EAX, the product goes into the 
EDX:EAX register pair. The carry and overflow flags are set if the product is sign- 
extended into DX for 16-bit operands, into AH for 8-bit operands, or into EDX for 
32-bit operands. 


86 IMUL Signed Multiply 


Flags 


Encoding 


Encoding 


Two additional syntaxes are available on the 80186-80486 processors. In the two- 
operand form, a 16-bit register gives one of the factors and serves as the destination 
for the result; a source constant specifies the other factor. In the three-operand form, 
the first operand is a 16-bit register where the result will be stored, the second is a 
16-bit register or memory operand containing one of the factors, and the third is a 
constant representing the other factor. With both variations, the overflow and carry 
flags are set if the result is too large to fit into the 16-bit destination register. Since 
the low 16 bits of the product are the same for both signed and unsigned 
multiplication, these syntaxes can be used for either signed or unsigned numbers. 
On the 80386-80486, the operands can be either 16 or 32 bits wide. 


A fourth syntax is available on the 80386-80486. Both the source and destination 
operands can be given specifically. The source can be any 16- or 32-bit memory 
operand or general-purpose register. The destination can be any general-purpose 
register of the same size. The overflow and carry flags are set if the product does 
not fit in the destination. 


ODI TSZAPC 
+ a ae 


1111011w mod, 101,r/m_ disp (0, 1, or 2) 


Syntax Examples CPU Clock Cycles 
IMUL reg jmul_ dx ~ 88/86 b=80-98, w=128-154 
286 — b=13,w=21 
386. b=9-14,w=9-22,d=9-38* 
486 b=13-18,w=13-26,d=13-42 
IMUL mem imul factor 88/86 (b=86—104,w=134—-160)+EAF 
286 b=16,w=24 
386 b=12~—17,w=12-25 ,d=12-41* 
486 b=13-18,w=13-26, d=13-42 


* The 80386-80486 processors have an early-out multiplication algorithm. Therefore, multiplying an 
8-bit or 16-bit value in EAX takes the same time as multiplying the value in AL or AX. 


+ Word memory operands on the 8088 take (138-164)+EA clocks. 


011010s1 mod,reg,rim disp (0,1,o0r2) data (1 or 2) 


Syntax Examples CPU = Clock Cycles 
IMUL regl6,immed imul cx,25 88/86 — 
IMUL reg32,immed* 286 21 


386 b=9-14,w=9-22,d=9-38+ 
486 b=13-18, w=13-26,d=13-42 


IMUL reg/6,reg16,immed jmul 88/86 = — 

IMUL reg32,reg32,immed* dx,ax,18 286 21 ‘ 
386 b=9-14,w=9-22,d=9-38+ 
486 b=13-18,w=13-26,d=13-42 


Encoding 


IN Input from Port 87 


Syntax Examples CPU = Clock Cycles 


IMUL regl6,mem16,immed imu] 88/86 — 

IMUL reg32,mem32,immed* bx, [si],60 286 24 
386 b=12-17,w=12-25,d=12-41+ 
486 b=13-18, w=13-26,d=13-42 


00001111 10101111 mod,reg,r/m disp (0,1, or 2) 


Syntax Examples CPU Clock Cycles 
IMUL reg/6,regl6 jmul cx,ax 88/86 — 
IMUL reg32,reg32* 286 —_ 
386 =9-22 d=9-38 
486 b=13-18 w=13-26,d=13-42 
IMUL reg]6,meml6 imul | 88/86 — 
IMUL reg32,mem32* dx, [si] 286 — 


386 w=12-25 d=12-41 
486 b=13-18, w=13-26,d=13-42 


* 80386-80486 only. 
+ The variations depend on the source constant size; destination size is not a factor. 


IN Input from Port 


Flags 


Encoding 


Transfers a byte or word (or doubleword on the 80386-80486) from a port to the 
accumulator register. The port address is specified by the source operand, which 
can be DX or an 8-bit constant. Constants can be used only for port numbers less 
than 255; use DX for higher port numbers. In protected mode, a general-protection 
fault occurs if IN is used when the current privilege level is greater than the value 
of the IOPL flag. 


No change 
1110010w data(l) 


Syntax Examples CPU Clock Cycles 
IN accum,immed in ax,6@h 88/86 10 (W8&8=14) 
286 5 


386. —-:12,pm=6,26* 
486 14, pm=9,29*+ 


88 INC Increment 


Encoding 1110110w 
Syntax - Examples CPU = Clock Cycles 
IN accum,DX in ax,dx 88/86 38 (W8&8=12) 


in al,dx 286 5 
386 13,pm=7,27* 
486 14,pm=8 ,28*+ 


* First protected-mode timing: CPL < IOPL. Second timing: CPL > IOPL. 
+ Takes 27 clocks in virtual 8086 mode. 


INC Increment 


Adds 1 to the destination operand. Because the operand is treated as an unsigned 
integer, the INC instruction does not affect the carry flag. If a signed carry requires 
detection, use the ADD instruction. 


Flags ODI TS ZAPC 
t pe cals 
Encoding 1111111w mod,000,rlm_— disp (0, I, or 2) 
Syntax Examples CPU Clock Cycles 
INC reg8 ine. cl 88/86 3 
286 2 
386 2 
486 1 
INC mem inc vpage 88/86 15+EA (W8&8=23+EA) 
286 7 
386 6 
486 3 
Encoding 01000 reg 
Syntax Examples . CPU Clock Cycles 
INC regl6 inc bx 88/86 3 
INC reg32* 286 2 
386 2 
486 1 


* 80386-80486 only. 


INT Interrupt 89 


INS/INSB/INSW/INSD Input from Port to String 


Flags 


Encoding 


80286-80486 Only Receives a string from a port. The string is considered the 
destination and must be pointed to by ES:DI (even if an operand is given). The 
input port is specified in DX. For each element received, DI is adjusted according to 
the size of the operand and the status of the direction flag. DI is increased if the 
direction flag has been cleared with CLD or decreased if the direction flag has been 
set with STD. 


If the INS form of the instruction is used, a destination operand must be provided to 
indicate the size of the data elements to be processed, and DX must be specified as 
the source operand containing the port number. A segment override is not allowed. 
If INSB (bytes), INSW (words), or INSD (doublewords on the 80386-80486 only) 
is used, the instruction determines the size of the data elements to be received. 


INS and its variations are normally used with the REP prefix. Before the repeated 
instruction is executed, CX should contain the number of elements to be received. 
In protected mode, a general-protection fault occurs if INS is used when the current 
privilege level is greater than the value of the IOPL flag. 


No change 

0110110w 

Syntax Examples CPU | Clock Cycles 
INS [ES:]] dest, DX ins es:instr,dx | 88/86 — 

INSB [[ES:]] dest, DX] rep insb 286 5 

INSW [[ES:]]| dest, DX] ~=rep  insw 386 15,pm=9,29* 
INSD [[ES:]] dest, DX] rep insd 486 17,pm=10,32* 


* First protected-mode timing: CPL < IOPL. Second timing: CPL > IOPL. 


INT Interrupt 


Generates a software interrupt. An 8-bit constant operand (0 to 255) specifies the 
interrupt procedure to be called. The call is made by indexing the interrupt number 
into the Interrupt Vector Table (IVT) starting at segment 0, offset 0. In real mode, 
the IVT contains 4-byte pointers to interrupt procedures. In privileged mode, the 
IVT contains 8-byte pointers. 


When an interrupt is called in real mode, the flags, CS, and IP are pushed onto the 
stack (in that order), and the trap and interrupt flags are cleared. STI can be used to 
restore interrupts. See Intel documentation and the documentation for your 


90 INTO Interrupt on Overflow 


Flags 


Encoding 


Encoding 


INTO 


Flags 


Encoding 


operating system for details on using and defining interrupts in privileged mode. To 
return from an interrupt, use the IRET instruction. 


ODITS ZAPC 
0 0 


11001101 data(1) 


Syntax Examples CPU Clock Cycles 

INT immed8s int 25h 88/86 51 (88=71) 
286 23+m,pm=(40,78)+m* 
386 37,pm=59,99* 
486 30,pm=44,71* 

11001100 

Syntax Examples CPU Clock Cycles 

INT 3 int 3 88/86 52 (88=72) 

286 23+m,pm=(40,78)+m* 

386 33,pm=59,99* 
486 26,pm=44,71* 


* The first protected-mode timing is for interrupts to the same privilege level. The second is for 
interrupts to a higher privilege level. Timings for interrupts through task gates are not shown. 


Interrupt on Overflow 


Generates Interrupt 4 if the overflow flag is set. The default MS-DOS behavior for 
Interrupt 4 is to return without taking any action. For INTO to have any effect, you 
must define an interrupt procedure for Interrupt 4. — 


ODITS ZAPC 


aaa 
11001110 
Syntax Examples CPU = _ Clock Cycles 
INTO into 88/86 53 (88=73),noj=4 
286 24+m,noj=3,pm=(40, 
78)+m* 


386 35 noj=3 pm=59,99* 
486 28,noj=3,pm=46,73* 


* The first protected-mode timing is for interrupts to the same privilege level. The second is for 
interrupts to a higher privilege level. Timings for interrupts through task gates are not shown. 


INVLPG Invalidate TLB Entry 91 


INVD  Invalidate Data Cache 


Flags 


Encoding 


INVLPG 


Flags 


Encoding 


80486 Only Empties contents of the current data cache without writing changes to 
memory. Proper use of this instruction requires knowledge of how contents are 
placed in the cache. INVD is intended primarily for system programming. See Intel 
documentation for details. , 


No change 
00001111 00001000 


Syntax Examples CPU Clock Cycles 
INVD invd 88/86 — 

286 — 

386 — 

486 4 


Invalidate TLB Entry 


80486 Only Invalidates an entry in the Translation Lookaside Buffer (TLB), used 
by the demand-paging mechanism in virtual-memory operating systems. The 
instruction takes a single memory operand and calculates the effective address of 
the operand, including the segment address. If the resulting address is mapped by 
any entry in the TLB, this entry is removed. Proper use of INVLPG requires 
understanding the hardware-supported demand-paging mechanism. INVLPG is 
intended primarily for system programming. See Intel documentation for details. 


No change 
00001111 O0000001 mod, reg,r/m_ disp (2) 


Syntax Examples CPU —=_ Clock Cycles 
INVLPG invipg pointer[bx] 88/86 — 
invlpg es:entry 286 — 
386 — 
486 | 12 


* 11 clocks if address is not mapped by any TLB entry. 


92 IRET/IRETD Interrupt Return 


IRET/IRETD Interrupt Return 


Flags 


Encoding 


Returns control from an interrupt procedure to the interrupted code. In real mode, 
the IRET instruction pops IP, CS, and the flags (in that order) and resumes 
execution. See Intel documentation for details on IRET operation in privileged 
mode. On the 80386-80486, the IRETD instruction should be used to pop a 32-bit 
instruction pointer when returning from an interrupt called from a 32-bit segment. 
The F suffix prevents epilogue code from being generated when ending a PROC 
block. Use it to terminate interrupt service procedures. 


ODITSZAPC 
t+eetttete tet 


11001111 

Syntax Examples CPU = _ Clock Cycles 

IRET iret 88/86 32 (88=44) 

IRETD* 286 17+m,pm=(31,55)+mt 
IRETF 386 —-22,pm=38,82+ 
IRETDF* | 486 15,pm=20,36 


* 80386-80486 only. 


+ The first protected-mode timing is for interrupts to the same privilege level within a task. The second 
is for interrupts to a higher privilege level within a task. Timings for interrupts through task gates are 
not shown. ; 


Jcondition Jump Conditionally 


Flags 


Transfers execution to the specified label if the flags condition is true. The 
condition is tested by checking the flags shown in the table on the following page. 
If condition is false, no jump is taken and program execution continues at the next 
instruction. On the 8086-80286 processors, the label given as the operand must be 
short (between —128 and +127 bytes from the instruction following the jump).”* The 
80386-80486 processors allow near jumps (—32,768 to +32,767 bytes). On the 
80386-80486, the assembler generates the shortest jump possible, unless the jump 
size is explicitly specified. 


When the 80386-80486 processors are in FLAT memory model, short jumps range 
from —128 to +127 bytes and near jumps range from —2 to +2 gigabytes. There are 
no far jumps. 


No change 


Encoding 


Encoding 


Jump Conditions 


Jcondition Jump Conditionally 


Olllcond disp (1) 


Syntax Examples 
Jcondition label jg bigger 
jo SHORT too_big 
jpe p_even 
00001111 1000cond disp (2) 
Syntax Examples 
Jcondition label*+ je next 


93 


jnae lesser 


js 


negative 


CPU Clock Cycles 
88/86 16,noj=4 

286 7+m,noj=3 
386 7+m,noj=3 
486 3,noj=1 

CPU Clock Cycles 
88/86 — 

286 — 

386 7+m,noj=3 
486 3,noj=1 


* Tf a source file for an 8086-80286 program contains a conditional jump outside the range of —128 to 
+127 bytes, the assembler emits a level 3 warning and generates two instructions (including an 
unconditional jump) that are the equivalent of the desired instruction. This behavior can be enabled 
and disabled with the OPTION LJMP and OPTION NOLJMP directives. 


+ Near labels are only available on the 80386-80486. They are the default. 


Opcode* 
size 0010 


size 0011 
size 0110 
size 0111 


size 0100 
size 0101 
size 1100 


size 1101 
size 1110 
size 1111 


size 1000 
size 1001 


Mnemonic 


JB/JNAE 


JAE/JNB 


JBE/JNA 


JA/JNBE 


JE/JZ 
JNE/JNZ 
JL/JNGE 


JGE/JNL 


JLE/JNG 


JG/JNLE 


JS 


_ JNS 


Flags Checked 
CF=1 


CF=0 
CF=1 or ZF=1 
CF=0 and ZF=0 


ZF=1 
ZF=0 
SF_OF 


SF=OF 

ZF=1 or SF_OF 
ZF=0 and 
SF=OF 


SF=1 
SF=0 


Description 


Jump if below/not above or equal 
(unsigned comparisons) 


Jump if above or equal/not below 
(unsigned comparisons) 


Jump if below or equal/not above 
(unsigned comparisons) 


Jump if above/not below or equal 
(unsigned comparisons) 


Jump if equal (zero) 
Jump if not equal (not zero) 


Jump if less/not greater or equal 
(signed comparisons) 


Jump if greater or equal/not less 
(signed comparisons) 


Jump if less or equal/not greater 
(signed comparisons) 


Jump if greater/not less or equal 
(signed comparisons) 


Jump if sign 


Jump if not sign 


94 JCXZ/JECXZ Jump if CX is Zero 


Opcode* Mnemonic Flags Checked _ Description 

size 0010 JC CF=1 Jump if carry 

size 0011 JNC CF=0 Jump if not carry 

size 0000 JO OF=1 Jump if overflow 

size 0001 JNO OF=0 Jump if not overflow 

size 1010 JP/JPE PF=1 Jump if parity/parity even 
size 1011 JNP/JPO PF=0 Jump if no parity/parity odd 


* The size bits are 0111 for short jumps or 1000 for 80386-80486 near jumps. 


JCXZ/JECXZ Jump if CX is Zero 


Flags 


Encoding 


Transfers program execution to the specified label if CX is 0. On the 80386-80486, 
JECXZ can be used to jump if ECX is 0. If the count register is not 0, execution 
continues at the next instruction. The label given as the operand must be short 
(between —128 and +127 bytes from the instruction following the jump). 


No change 
11100011 disp (1) 


Syntax Examples CPU Clock Cycles 

JCXZ label jcxz: not found 88/86 18,noj=6 

JECXZ label* 286 8+m,noj=4 
386 9+m,noj=5 
486 8,noj=5 


* 80386-80486 only. 


JMP Jump Unconditionally 


Transfers program execution to the address specified by the destination operand. 
Jumps are near (between —32,768 and +32,767 bytes from the instruction following 
the jump), or short (between —128 and +127 bytes), or far (in a different code 
segment). Unless a distance is explicitly specified, the assembler selects the shortest 
possible jump. With near and short jumps, the operand specifies a new IP address. 
With far jumps, the operand specifies new IP and CS addresses. 


Flags 


Encoding 


Encoding 


Encoding 


Encoding 


When the 80386-80486 processors are in FLAT memory model, short jumps range 


JMP Jump Unconditionally 


from —128 to +127 bytes and near jumps range from —2 to +2 gigabytes. 


No change 
11101011 disp (1) 


Syntax Examples 


JMP label jmp SHORT exit 


11101001 disp (2*) 


Syntax Examples 


JMP label jmp close 
jmp NEAR PTR distant 


11101010 disp (4*) 


Syntax Examples 


JMP label jmp FAR PTR close 
jmp distant 


11111111 mod,100,r/m_ disp (0 or 2) 


Syntax Examples 

JMP regl6 jmp ax 

JMP mem32§ 

JMP mem16 jmp WORD PTR [bx] 
JMP mem32§ jmp table[{di] 


jmp  DWORD PTR [si] 


Clock Cycles 


15 
7+m 
7+m 
3 


Clock Cycles 


15 
7T+m 
7T+m 
| 


Clock Cycles 


15 
11+m,pm=23+m7y 
12+m,pm=27+mt 
17,pm=19F 


Clock Cycles 


11 
7+m 
7T+m 


96 LAHF Load Flags into AH Register 


Encoding 


11111111 mod,101,r/m_— disp (4*) 


Syntax Examples CPU Clock Cycles 

JMP mem32 jmp fpointer[si] 88/86 24+EA 

JMP mem48§ jmp DWORD PTR [bx] 286 15+m,pm=26+m 
jmp FWORD PTR [di] 386 12+m,pm=27+m 


486  13,pm=18 


* On the 80386-80486, the displacement can be 4 bytes for near jumps or 6 bytes for far jumps. 


+ Timings for jumps through call or task gates are not shown, since they are normally used only in 
operating systems. 


§ 80386-80486 only. You can use DWORD PTR to specify near register-indirect jumps or FWORD 
PTR to specify far register-indirect jumps. 


LAHF Load Flags into AH Register 


Flags 
Encoding 


Transfers bits 0 to 7 of the flags register to AH. This includes the carry, parity, 
auxiliary carry, zero, and sign flags, but not the trap, interrupt, direction, or 
overflow flags. 


No change 
10011111 
Syntax Examples CPU = Clock Cycles 
LAHF lahf 88/86 4 
286 2 
386 2, 
486 3 


LAR Load Access Rights 


80286-80486 Protected Only Loads the access rights of a selector into a specified 
register. The source operand must be a register or memory operand containing a 
selector. The destination operand must be a register that will receive the access 
rights if the selector is valid and visible at the current privilege level. The zero flag 
is set if the access rights are transferred, or cleared if they are not. See Intel 
documentation for details on selectors, access rights, and other privileged-mode 
concepts. 


LDS/LES/LFS/LGS/LSS Load Far Pointer 97 


Flags ODITSZAPC 
= 5 
Encoding 00001111 00000010 mod, reg,r/m_ disp (0, 1, 2, or 4) 
Syntax Examples CPU 
LAR reg!6,reg16 lar ax,bx 88/86 
LAR reg32,reg32* 286 
386 
486 
LAR regl6,meml6 lar cx,selector 88/86 
LAR reg32,mem32* 286 
386 
486 


* 80386-80486 only. 


LDS/LES/LFS/LGS/LSS Load Far Pointer 


Reads and stores the far pointer specified by the source memory operand. The 
instruction moves the pointer’s segment value into DS, ES, FS, GS, or SS 
(depending on the instruction). Then it moves the pointer’s offset value into the 
destination operand. The LDS and LES instructions are available on all processors. 
The LFS, LGS, and LSS instructions are available only on the 80386-80486. 


Flags No change 
Encoding 11000101 mod,reg,r/m_ disp (2) 
Syntax Examples 
LDS reg,mem lds si,fpointer 
Encoding 11000100 mod,reg,r/m_ disp (2) 
Syntax | Examples 
LES reg,mem les di,fpointer 


CPU 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


Clock Cycles 


16+EA (88=24+EA) 
7,pm=21 
7,pm=22 
6,pm=12 


Clock Cycles 


16+EA (88=24+EA) 
7,pm=21 
7,pm=22 
6,pm=12 


98 LEA Load Effective Address . 


Encoding 00001111 10110100 mod,reg,r/m_ disp (2 or 4) 
Syntax Examples CPU Clock Cycles 
LFS reg,mem lfs edi,fpointer 88/86 — 
286 — 


386 7,pm=25 
486 6,pm=12 


Encoding 00001111 10110101 mod,reg,r/m_ disp (2 or 4) 
Syntax Examples CPU — Clock Cycles 
LGS reg,mem lgs bx,fpointer 88/86 — 
. 286 — 


386 7,pm=25 
486 6,pm=12 


Encoding 00001111 10110010 mod,reg,r/m_ disp (2 or 4) 
Syntax Examples CPU Clock Cycles 
LSS reg,mem Iss bp,fpointer 88/86 3 — 
286 — 


386 7,pm=22 
486 6,pm=12 


LEA Load Effective Address 


Calculates the effective address (offset) of the source memory operand and stores 
the result in the destination register. If the source operand is a direct memory 
address, the assembler encodes the instruction in the more efficient MOV 

reg, immediate form (equivalent to MOV reg, OFFSET mem). 


Flags No change 
Encoding 10001101 mod,reg,r/m_ disp (2) 
Syntax Examples — CPU Clock Cycles 
LEA regl6,mem lea bx,npointer 88/86 2+EA 
LEA reg32,mem* 286 3 
386 Z 
486 ly 


* 80386-80486 only. 


+ 2 if index register used. 


LGDT/LIDT/LLDT Load Descriptor Table 99 


LEAVE High Level Procedure Exit 


Flags 


Encoding 


Terminates the stack frame of a procedure. LEAVE reverses the action of a 
previous ENTER instruction by restoring SP and BP to the values they had before 
the procedure stack frame was initialized. LEAVE is equivalent to mov sp,bp, 
followed by pop bp. 


No change 
11001001 
Syntax Examples CPU = Clock Cycles 
LEAVE leave 88/86 — 
286 5 
386 4 
486 i) 


LES/LFS/LGS Load Far Pointer to Extra Segment 


See LDS. 


LGDT/LIDT/LLDT Load Descriptor Table 


Flags 


Encoding 


Loads a value from an operand into a descriptor table register. LGDT loads into the 
Global Descriptor Table, LIDT into the Interrupt Vector Table, and LLDT into the 
Local Descriptor Table. These instructions are available only in privileged mode. 


See Intel documentation for details on descriptor tables and other protected-mode 


concepts. 
No change 
00001111 00000001 mod, 010,r/m_ disp (2) 


Syntax Examples CPU Clock Cycles 
LGDT mem48 lgdt descriptor 88/86 — 

286 11 

386 11 


486 11 


100 LMSW Load Machine Status Word 


Encoding 00001111 00000001 mod, OI1,r/m_ disp (2) 


Syntax. Examples CPU Clock Cycles 

LIDT mem48 lidt descriptor 88/86 — 

286 12 

386 11 

486 Ls 

Encoding 00001111 00000000 mod,010,r/m_ disp (0, 1, or 2) 

| Syntax — Examples CPU —_ Clock Cycles 

LLDT regl6 lidt ax 88/86 — 

286 17 

386 20 

486 11 

LLDT meml6 lldt selector 88/86 — 

286 19 

386 24 

486 11 


LMSW Load Machine Status Word 


80286-80486 Privileged Only Loads a value from a memory operand into the 
Machine Status Word (MSW). This instruction is available only in privileged 
mode. See Intel documentation for details on the MSW and other protected-mode 


concepts. 
Flags No change 
Encoding 00001111 00000001 mod, 110,r/m_ disp (0, 1, or 2) 
Syntax _ Examples CPU Clock Cycles 
LMSW regl6 lmsw ax 88/86 — 
286 3 
386 10 
486 13 
LMSW mem16 Imsw machine 88/86 — 
286 6 
386 13 


486 13 


LODS/LODSB/LODSW/LODSD Load Accumulator from String 101 


LOCK Lock the Bus 


Locks out other processors during execution of the next instruction. This instruction 
is a prefix. It must precede an instruction that accesses a memory location that 
another processor might attempt to access at the same time. See Intel documentation 
for details on multiprocessor environments. 


Flags No change 
Encoding 11110000 
Syntax Examples CPU Clock Cycles 
LOCK instruction lock xchg ax,sem 88/86 2 
286 0 
386 0 
486 1 


LODS/LODSB/LODSW/LODSD Load Accumulator 
from String 


Loads the accumulator register with an element from a string in memory. DS:SI 
must point to the source element, even if an operand is given. For each source 
element loaded, SI is adjusted according to the size of the operand and the status of 
the direction flag. SI is incremented if the direction flag has been cleared with CLD 
or decremented if the direction flag has been set with STD. 


If the LODS form of the instruction is used, an operand must be provided to 
indicate the size of the data elements to be processed. A segment override can be 
given. If LODSB (bytes), LODSW (words), or LODSD (doublewords on the 
80386-80486 only) is used, the instruction determines the size of the data elements 
to be processed and whether the element will be loaded to AL, AX, or EAX. 


LODS and its variations are not used with repeat prefixes, since there is no reason 
to repeatedly load memory values to a register. 


Flags No change 


102 


Encoding 


LOOP/LOOPW/LOOPD Loop 


1010110w 

Syntax Examples CPU Clock Cycles 
LODS [segreg:]src lods es:source 88/86 12 (W&8&=16) 
LODSB [[segreg:]src]] -  lodsw 286 5 
LODSWI[[segreg:] src] 386 5 

LODSD [[[segreg:]src] 486 5 


LOOP/LOOPW/LOOPD Loop 


Flags 


Encoding 


Loops repeatedly to a specified label. LOOP decrements CX (without changing any 
flags) and, if the result is not 0, transfers execution to the address specified by the 
operand. On the 80386-80486, LOOP uses the 16-bit CX in 16-bit mode and the 
32-bit ECX in 32-bit mode. The default can be overridden with LOOPW (CX) or 
LOOPD (ECX). If CX is 0 after being decremented, execution continues at the 
next instruction. The operand must specify a short label (between —128 and +127 
bytes from the instruction following the LOOP instruction). 


No change 
11100010 disp (1) 


Syntax Examples CPU = Clock Cycles 
LOOP label loop wend 88/86 =17,noj=5 
LOOPW label* 286 8+m,noj=4 
LOOPD label* 386 1l+m 

486 7,noj=6 


* 80386-80486 only. 


LOOPcondition/LOOPconditionW/LOOPconditionD 
Loop Conditionally 


Loops repeatedly to a specified label if condition is met and if CX is not 0. On the 
80386-80486, these instructions use the 16-bit CX in 16-bit mode and the 32-bit 
ECX in 32-bit mode. This default can be overridden with the W (CX) or D (ECX) 
forms of the instruction. The instruction decrements CX (without changing any 
flags) and tests whether the zero flag was set by a previous instruction (such as 
CMP). With LOOPE and LOOPZ (they are synonyms), execution is transferred 
to the label if the zero flag is set and CX is not 0. With LOOPNE and LOOPNZ 


Flags 


Encoding 


Encoding 


LSL Load Segment Limit 103 


(they are synonyms), execution is transferred to the label if the zero flag is cleared 
and CX is not 0. Execution continues at the next instruction if the condition is not 
met. Before entering the loop, CX should be set to the maximum number of 


repetitions desired. 
No change 
11100001 = disp (J) 


Syntax Examples 


LOOPE label loopz again 
LOOPEW label* 

LOOPED label* 

LOOPZ label 

LOOPZW label* 

LOOPZD label* 


11100000 disp (1) 


Syntax Examples 


LOOPNE label loopnz for_next 
LOOPNEW label* 

LOOPNED label* 

LOOPNZ label 

LOOPNZW label* 

LOOPNZD label* 


* 80386-80486 only. 


LSL Load Segment Limit 


80286-80486 Protected Only Loads the segment limit of a selector into a specified 
register. The source operand must be a register or memory operand containing a 
selector. The destination operand must be a register that will receive the segment 
limit if the selector is valid and visible at the current privilege level. The zero flag is 
set if the segment limit is transferred, or cleared if it is not. See Intel documentation 
for details on selectors, segment limits, and other protected-mode concepts. 


Flags 


ODITS ZAPC 
+ 


CPU 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


18,noj=6 
8+m,noj=4 
11+m 
9,noj=6 


Clock Cycles 


19,noj=5 
8,noj=4 
11+m 
9,noj=6 


104 LSS _ Load Far Pointer to Stack Segment 


Encoding 00001111 00000011 mod,reg,r/m_ disp (0, I, or 2) 
Syntax . Examples CPU = Clock Cycles 
LSL regl6,reg16 Isl ax,bx 88/86 — 
LSL reg32,reg32* 286 14 
386 20,25+ 
| 486 10 
LSL regl6,meml6 Isl cx,seg_lim 88/86 — 
LSL reg32,mem32* 286 16 
386 21,267 
486 10 


* 80386-80486 only. 


t The first value is for byte granular; the second is for page granular. 


LSS Load Far Pointer to Stack Segment 


See LDS. 


LTR Load Task Register 


80286-80486 Protected Only Loads a value from the specified operand to the 
current task register. LTR is available only in privileged mode. See Intel 
documentation for details on task registers and other protected-mode concepts. 


Flags No change 
Encoding 00001111 00000000 mod, O1I,rim_ disp(0,l,or2) 
Syntax Examples CPU = Clock Cycles 
LTR regl6 ltr ax 88/86 — 
286 17 
386 23 
486 20 
LTR meml6 Itr task —-88/86 
286 19 
386 27 


486 20 


MOV 


Flags 


Encoding 


Encoding 


Encoding 


Move Data 


MOV Move Data 105 


Moves the value in the source operand to the destination operand. If the destination 
operand is SS, interrupts are disabled until the next instruction 1s executed (except 


on early versions of the 8088 and 8086). 
No change 
100010dw mod,reg,r/m_ disp (0, 1, or 2) 


Syntax Examples 
MOV reg,reg mov dh,bh 
mov dx,cx 
mov bp,sp 
MOV mem,reg mov array[di],bx 


mov count,cx 


MOV reg,mem mov bx,pointer 
mov. dx,matrix[bx+di] 


1100011w mod,000,r/m disp (0,1,o0r2) data(1 or 2) 


Syntax Examples 


MOV mem,immed mov [bx],15 
mov color,/7 


10llwreg data(l or 2) 


Syntax Examples 


MOV reg,immed mov cx,256 
mov dx,OFFSET string 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 


486 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


2 
2 


2 


1 


9+EA (W88=13+EA) 
3 | 

2 

1 


8+EA (W88=12+EA) 
5 
4 
l 


Clock Cycles 


10+EA (W88=14+EA) 
3 
2 
1 


Clock Cycles 


4 
2 
2 
1 


106 MOV Move to/from Special Registers 


Encoding 101000aw disp (2) 
Syntax Examples CPU — Clock Cycles 
MOV mem,accum mov total,ax 88/86 10 (W8&8=14) 
286 3 
386 2 
486 1 
MOV accum,mem mov al,string 88/86 10(W8&8=14) 
286 5 
386 4 
486 1 
Encoding 100011d0 mod,sreg,r/m_ disp (0, 1, or 2) 
Syntax Examples CPU = Clock Cycles 
MOV segreg,regl6 mov ds,ax 88/86 2 
286 2,pm=17 
386 2,pm=18 
486 3,pm=9 
MOV segreg,meml6 mov es,psp 88/86 8+EA (88=12+EA) 
286 5,pm=19 
386 5,pm=19 
486 3,pm=9 
MOV reg/6,segreg mov ax,ds - 88/86 2 
286 pe 
386 2 
486 3 
MOV meml16,segreg mov stack_save,ss 88/86 9+EA (88=13+EA) 
286 3 
386 2 
486 3 


MOV Move to/from Special Registers 


80386-80486 Only Moves a value from a special register to or from a 32-bit 
general-purpose register. The special registers include the control registers CRO, 
CR2, and CR3; the debug registers DRO, DR1, DR2, DR3, DR6, and DR7; and the 
test registers TR6 and TR7. On the 80486, the test registers TR3, TR4, and TR5 
are also available. See Intel documentation for details on special registers. 


Flags ee eas a 
? DOS Se AP 


Encoding 


Encoding 


Encoding 


MOV Move to/from Special Registers 107 


00001111 001000d0 11, reg*,r/m 


Syntax Examples 
MOV reg32, controlreg mov eax,cr2 
MOV controlreg,reg32 mov crQ,ebx 


00001111 001000d1 11, ,reg*,r/m 


Syntax Examples 
MOV reg32,debugreg mov edx,dr3 
MOV debugreg,reg32 mov drQ,ecx 


00001111 001001d0 11,reg*, r/m 


Syntax Examples 
MOV reg32,testreg mov edx,tr6 
MOV testreg, reg32 mov tr7,eax 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


Clock Cycles 


CRO=10,CR2=4,CR3= 
5 
4,CRO=16 


Clock Cycles 


DRO-3=22,DR6-7=14 
10 


DRO-3=22,DR6—7=16 
11 


Clock Cycles 


12 
4,TR3=6 


* The reg field contains the register number of the special register (for example, 000 for CRO, 011 for 


DR7, or 111 for TR7). 


108 


MOVS/MOVSB/MOVSWI/MOVSD Move String Data 


MOVS/MOVSB/MOVSW/MOVSD Move String Data 


Moves a string from one area of memory to another. DS:SI must point to the source 
string and ES:DI to the destination address, even if operands are given. For each 
element moved, DI and SJ are adjusted according to the size of the operands and the 
status of the direction flag. They are increased if the direction flag has been cleared 
with CLD, or decreased if the direction flag has been set with STD. 


If the MOVS form of the instruction is used, operands must be provided to indicate 
the size of the data elements to be processed. A segment override can be given for 
the source operand (but not for the destination). If MOVSB (bytes), MOVSW 
(words), or MOVSD (doublewords on the 80386-80486 only) is used, the 
instruction determines the size of the data elements to be processed. 


MOVS and its variations are normally used with the REP prefix. 


Flags No change 

Encoding 1010010w 

Syntax Examples CPU = Clock Cycles 
MOVS [ES: ]ldest,[[segreg:]src | rep. movsb 88/86 18 (W88=26) 
MOVSB [[[ES: ]dest,[[segreg:]src]] movs dest,es:source 286 5 

MOVSW [[ES: ]ldest,[[segreg:]]src]] 386 7 

MOVSD [[ES: ]dest,[segreg:]]src]] 486 fi 


MOVSX Move with Sign-Extend 


Flags 


Encoding 


80386-80486 Only Moves and sign-extends the value of the source operand to the 
destination register. MOVSX is used to copy a signed 8-bit or 16-bit source 


operand to a larger 16-bit or 32-bit destination register. 
No change 
00001111 1011111w mod,reg,r/m_ disp (0,1, 2, or 4) 


Syntax Examples CPU Clock Cycles 
MOVSX reg,reg movsx  eax,bx 88/86 — 

movsx  ecx,b] 286 — 

movsx bx,al 386 a 


486 3 


MUL Unsigned Multiply 109 


Syntax Examples CPU Clock Cycles 
MOVSX reg,mem movsx  cx,bsign 88/86 — 
movsx  edx,wsign 286 — 
movsx  eax,bsign 386 6 
486 3 


MOVZX Move with Zero-Extend 


Flags 


Encoding 


80386-80486 Only Moves and zero-extends the value of the source operand to the 
destination register. MOVZX is used to copy an unsigned 8-bit or 16-bit source 
operand to a larger 16-bit or 32-bit destination register. 


No change 
00001111 1011011w mod,reg,r/m_ disp (0, 1,2, or 4) 


Syntax Examples CPU = Clock Cycles 

MOVZX reg,reg movzx eax,bx 88/86 — 
movzx  ecx,bl 286 — 

movzx bx, al 386 3 

486 3 
MOVZX reg,mem movzx cx,bunsign 88/86 — 
movzx edx,wunsign 286 — 

movzx eax,bunsign 386 6 

486 3 


MUL Unsigned Multiply 


. Flags 


Multiplies an implied destination operand by a specified source operand. Both 
operands are treated as unsigned numbers. If a single 16-bit operand is given, the 
implied destination is AX and the product goes into the DX:AX register pair. If a 
single 8-bit operand is given, the implied destination is AL and the product goes 
into AX. On the 80386-80486, if the operand is EAX, the product goes into the 
EDX:EAX register pair. The carry and overflow flags are set if DX is not 0 for 16- 
bit operands or if AH is not 0 for 8-bit operands. 


ODI TSZAPC 
+ RP Oe ab 


110 


Encoding 


NEG Two’s Complement Negation 


1111011w mod, 100, r/m_ disp (0, 1, or 2) 


Syntax 
MUL reg 


MUL mem 


Examples 
mul bx 
mul dl 


mul factor 
mul WORD PTR [bx] 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


Clock Cycles 


b=70-77, w=118—-133 
b=13,w=21 
b=9-14,w=9-22,d=9-38* 
b=13-18,w=13-26,d=13-42 


(b=76-83,w=124—-139)+EAT 
b=16,w=24 
b=12-17,w=12—25,d=12-41* 
b=13-18,w=13-26,d=13-42 


* The 80386-80486 processors have an early-out multiplication algorithm. Therefore, multiplying an 
8-bit or 16-bit value in EAX takes the same time as multiplying the value in AL or AX. 


+ Word memory operands on the 8088 take (128-143)+EA clocks. 


NEG Two’s Complement Negation 


Flags 


Encoding 


Replaces the operand with its two’s complement. NEG does this by subtracting the 
operand from 0. If the operand is 0, the carry flag is cleared. Otherwise, the carry 
flag is set. If the operand contains the maximum possible negative value (—128 for 
8-bit operands or —32,768 for 16-bit operands), the value does not change, but the 
overflow and carry flags are set. 


+ 


1111011w 


Syntax 
NEG reg 


NEG mem 


ODI TSZAPC 
ale 


pe Se ae 


mod, 011, r/m_ disp (0, 1, or 2) 


Examples 


neg ax 


neg balance 


CPU Clock Cycles 


88/86 3 
286 2 
386 Z 
486 1 


88/86 16+EA (W85=24+EA) 
286 7 
386 6 
486 3 


NOT One’s Complement Negation 111 


NOP No Operation 


Performs no operation. NOP can be used for timing delays or alignment. 


Flags No change 
Encoding 10010000* 
Syntax Examples CPU 
NOP nop 88/86 
286 
386 
486 


* The encoding is the same as XCHG AX,AX. 


NOT One’s Complement Negation 


Clock Cycles 
3 


3 
3 
3 


Toggles each bit of the operand by clearing set bits and setting cleared bits. 


Flags No change 
Encoding 1111011w = mod,010,r/m_— disp (0,1,or2) 
Syntax Examples _ CPU 
NOT reg not ax 88/86 
286 
386 
486 
NOT mem not masker 88/86 
286 
386 


486 


Clock Cycles 


3 
2 
2 
I 


16+EA (W88=24+EA) 
- 
6 
3 


112 


OR 


Flags 


Encoding 


Encoding 


Encoding 


OR Inclusive OR 


Inclusive OR 


Performs a bitwise OR operation on the source and destination operands and stores 

_ the result to the destination operand. For each bit position in the operands, if either 
or both bits are set, the corresponding bit of the result is set. Otherwise, the 
corresponding bit of the result is cleared. 


ODITS ZAPC 
0 a cies eee me ee 


000010dw mod,reg,r/m_ disp (0, 1, or 2) 


Syntax Examples CPU = Clock Cycles 
OR reg,reg or ax,dx 88/86 83 
286 Z 
386 2 
486 1 
OR mem,reg or bits,dx 88/86 16+EA (W88=24+EA) 
or [bpt+6],cx 286 7 
386 7 
486 3 
OR reg,mem or bx,masker 88/86 9+EA (W88=13+EA) 
or dx,color[di] 286 7 
386 6 
486 2 
100000sw mod,001,r/m ‘disp (0,1,o0r2) data(l or 2) 
Syntax Examples CPU = Clock Cycles 
OR reg,immed or dx,110110b 88/86 4 
286 3 
- 386 2 
486 1 
OR mem,immed or flag_rec,8 88/86  (b=17,w=25)+EA 
286 q 
386 f; 
486 3 
0000110w data (1 or 2) 
Syntax Examples CPU = Clock Cycles 


OR accum,immed or ax,40h 88/86 4 
286 3 
386 2 

486 1 


OUTS/OUTSB/OUTSW/OUTSD Output String to Port 113 


OUT Output to Port 


Flags 


Encoding 


Encoding 


Transfers a byte or word (or a doubleword on the 80386-80486) to a port from the 
accumulator register. The port address is specified by the destination operand, 
which can be DX or an 8-bit constant. In protected mode, a general-protection fault 
occurs if OUT is used when the current privilege level is greater than the value of 
the IOPL flag. 


No change 
1110011w data (1) 


Syntax Examples CPU Clock Cycles 
OUT out 6Q@h,al 88/86 10 (88=14) 
immed8,accum 286 3 


386 10,pm=4,24* 
486 16,pm=11,31* 


1110111w 
Syntax Examples CPU — Clock Cycles 
OUT DX,accum out dx,ax 88/86 8 (88=12) 


out dx,al 286 3 
386 11,pm=5,25* 
486 16,pm=10,30* 


* First protected-mode timing: CPL < IOPL. Second timing: CPL > IOPL. 


OUTS/OUTSB/OUTSW/OUTSD Output String to Port 


80186-80486 Only Sends a string to a port. The string is considered the source .and 
must be pointed to by DS:SI (even if an operand is. given). The output port is 
specified in DX. For each element sent, SI is adjusted according to the size of the 
operand and the status of the direction flag. SI is increased if the direction flag has 
been cleared with CLD, or decreased if the direction flag has been set with STD. 


If the OUTS form of the instruction is used, an operand must be provided to 
indicate the size of data elements to be sent. A segment override can be given. If 
OUTSB (bytes), OUTSW (words), or OUTSD (doublewords on the 80386-80486 
only) is used, the instruction determines the size of the data elements to be sent. 


OUTS and its variations are normally used with the REP prefix. Before the 
instruction is executed, CX should contain the number of elements to send. In 


114 POP Pop 


Flags 


Encoding 


POP Pop 


Flags 


Encoding 


Encoding 


protected mode, a general-protection fault occurs if OUTS is used when the current 


privilege level is greater than the value of the IOPL flag. 


No change 

0110111w 

Syntax Examples CPU 
OUTS DX, [[segreg:] src rep outs 88/86 
OUTSB [DX, [segreg:] src] dx, buffer 286 
OUTSW [DX, [[segreg:]] src] outsb 386 
OUTSD [DX, [[segreg:] src] rep outsw 486 


* First protected-mode timing: CPL < IOPL. Second timing: CPL > IOPL. 


Clock Cycles 


5 
14,pm=8,28* 
17,pm=10,32* 


Pops the top of the stack into the destination operand. The value at SS:SP is copied 
to the destination operand and SP is increased by 2. The destination operand can be 
a memory location, a general-purpose 16-bit register, or any segment register 
except CS. Use RET to pop CS. On the 80386-80486, 32-bit values can be popped 
by giving a 32-bit operand. ESP is increased by 4 for 32-bit pops. 


No change 

01011 reg 

Syntax Examples CPU 

POP regl6 pop cx 88/86 

POP reg32* 286 
386 
486 

10001111 mod,000,r/m_— disp (2) 

Syntax Examples CPU 

POP meml6 pop param 88/86 

POP mem32* 286 
386 


486 


Clock Cycles 


8 (88=12) 
5 
4 
1 


Clock Cycles 


17+EA (88=25+EA) 
5 
5 
6 


POPA/POPAD Pop All 115 


Encoding 000,sreg,111 
Syntax Examples CPU Clock Cycles 
POP segreg pop es 88/86 8 (88=12) 
pop ds 286 5,pm=20 
pop ss 386 7,pm=21 
486 3,pm=9 
Encoding 00001111 10,sreg,001 
Syntax Examples CPU —_ Clock Cycles 
POP segreg* pop fs 88/86 — 
pop gs 286 — 
386 7,pm=21 
486 3,pm=9 


* 80386-80486 only. 


POPA/POPAD Pop All 


80186-80486 Only Pops the top 16 bytes on the stack into the eight general-purpose 
registers. The registers are popped in the following order: DI, SI, BP, SP, BX, DX, 
CX, AX. The value for the SP register is actually discarded rather than copied to 
SP. POPA always pops into 16-bit registers. On the 80386-80486, use POPAD to 
pop into 32-bit registers. 


Flags No change 
Encoding 01100001 
Syntax Examples CPU —_ Clock Cycles 
POPA popa 88/86 — 
POPAD* 286 19 
386 24 
486 9 


* 80386-80486 only. 


116 POPF/POPFD Pop Flags 


POPF/POPFD Pop Flags 


Flags 


Encoding | 


Pops the value on the top of the stack into the flags register. POPF always pops into 
the 16-bit flags register. On the 80386-80486, use POPFD to pop into the 32-bit 
flags register. . 


a Rs is as ie Rs es 
10011101 
Syntax | Examples CPU Clock Cycles 
POPF popf 88/86 8 (8S=12) 
POPFD* 286 5 

386 5 


486 9,pm=6 


* 80386-80486 only. 


PUSH/PUSHW/PUSHD Push 


Flags 


' Encoding 


Pushes the source operand onto the stack. SP is decreased by 2 and the source value 
is copied to SS:SP. The operand can be a memory location, a general-purpose 16- 
bit register, or a segment register. On the 80186-80486 processors, the operand can 
also be a constant. On the 80386-80486, 32-bit values can be pushed by specifying 
a 32-bit operand. ESP is decreased by 4 for 32-bit pushes. On the 8088 and 8086, 
PUSH SP saves the value of SP after the push. On the 80186-80486 processors, 
PUSH SP saves the value of SP before the push. The PUSHW and PUSHD 
instructions push a word (2 bytes) and a doubleword (4 bytes), respectively. 


No change 

01010 reg 

Syntax Examples CPU Clock Cycles 
PUSH regl6 push dx 88/86 11 (88=15) 
PUSH reg32* 286 3 

PUSHW regl6 386 2 


PUSHD reg32* 486 1 


PUSHA/PUSHAD Push All 117 


Encoding 11111111 mod, 110,r/m_— disp (2) 
Syntax Examples CPU Clock Cycles 
PUSH meml6 push [di] 88/86  16+EA (88=24+EA) 
PUSH mem32* push fcount 286 5 
386 5 
486 4 
Encoding 00,sreg,110 
Syntax Examples CPU Clock Cycles 
PUSH segreg push es 88/86 10(88=14) 
PUSHW segreg push ss 286 3 . 
PUSHD segreg* push cs 386 2 
486 3 
Encoding 00001111 10,sreg,000 
| Syntax Examples CPU Clock Cycles 
PUSH segreg push fs 88/86 — 
PUSHW segreg push gs 286 — 
PUSHD segreg* 386 2 
486 3 
Encoding 011010s0 data (Jl or 2) 
| Syntax Examples CPU Clock Cycles 
PUSH immed push ‘a’ 88/86 — 
PUSHW immed push 15000 286 3 
-PUSHD immed* 386 2 
486 1 


* 80386-80486 only. 


PUSHA/PUSHAD Push All 


80186-80486 Only Pushes the eight general-purpose registers onto the stack. The 
registers are pushed in the following order: AX, CX, DX, BX, SP, BP, SI, DI. The 
value pushed for SP is the value before the instruction. PUSHA always pushes 16- 
bit registers. On the 80386-80486, use PUSHAD to push 32-bit registers. 


Flags No change 


118 PUSHF/PUSHFD Push Flags 


Encoding 01100000 
Syntax Examples CPU = _ Clock Cycles 
PUSHA pusha 88/86 — 
PUSHAD* . 286 17 
386 18 
486 ite 


* 80386-80486 only. 


PUSHF/PUSHFD Push Flags 


Pushes the flags register onto the stack. PUSHF always pushes the 16-bit flags 
register. On the 80386-80486, use PUSHFD to push the 32-bit flags register. © 


Flags No change 
Encoding 10011100 
Syntax Examples CPU = _ Clock Cycles 
PUSHF pushf 88/86  10(88=14) 
PUSHFD* 286 3 
386 4 
486 4,pm=3 


* 80386-80486 only. 


RCL/RCR/ROL/ROR Rotate 


Rotates the bits in the destination operand the number of times specified in the 
source operand. RCL and ROL rotate the bits left; RCR and ROR rotate right. 


ROL and ROR rotate the number of bits in the operand. For each rotation, the 
leftmost or rightmost bit is copied to the carry flag as well as rotated. RCL and 
RCR rotate through the carry flag. The carry flag becomes an extension of the 
operand so that a 9-bit rotation is done for 8-bit operands, or a 17-bit rotation for 
16-bit operands. 


On the 8088 and 8086, the source operand can be either CL or 1. On the 
80186-80486, the source operand can be CL or an 8-bit constant. On the 
80186-80486, rotate counts larger than 31 are masked off, but on the 8088 and 
8086, larger rotate counts are performed despite the inefficiency involved. The 


Flags 


Encoding 


Encoding 


RCL/RCR/ROL/ROR Rotate 
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overflow flag is modified only by single-bit variations of the instruction; for 
multiple-bit variations, the overflow flag is undefined. 


ODI TS ZAPC 


+ 


+ 


1101000w mod, TIT*,r/m_ disp (0, 1, or 2) 


Syntax 


ROL reg,1 
ROR reg,1 


RCL reg,1 
RCR reg,1 


ROL mem,1 
ROR mem,1 


RCL mem,1 
RCR mem,1 


Examples 


ror 
rol 


rcl 
rer 


ror 
rol 


rcl 
rer 


ax,l 
d1,l 


bits,l 
WORD PTR [bx],1 


WORD PTR [si],1 
WORD PTR m32[0],1 


1101001w mod, TTT*,r/m_ disp (0, 1, or 2) 


Syntax 


ROL reg,CL 
ROR reg,CL 


RCL reg,CL 
RCR reg,CL 


ROL mem,CL 
ROR mem,CL 


Examples 


ror 
rol 


rol 


ax,cl 
dx,cl 


dx,cl 
bl,cl 


color,cl 


WORD PTR [bp+6],cl 


CPU 
88/86 


486 
88/86 


486 
88/86 


486 
88/86 


Clock Cycles 


54+EA (W88=23+EA) 


5+EA (W88=23+EA 


0 


Bene PAAR WONND WWNWND 


Clock Cycles 


8+4n 
5+n 
3 

3 


8+4n 

5+n 

9 

8-30 

20+EA+4n 
(W8&8=28+EA+4n) 
8+n 


120 REP Repeat String 


Syntax — Examples CPU = Clock Cycles 
RCL mem,CL rcr WORD PTR [bx+di],cl 88/86 20+KFA+4n 
RCR mem,CL (W88=28+EA+4n) 
rcl_ masker 286 8+n 
386 10 
486 9-31 
Encoding 1100000w mod,TTT*,rlm disp (0,1, or 2) data (1) 
Syntax Examples CPU = Clock Cycles 
ROL reg,immed8 rol. ax,13 88/86 — 
ROR reg,immed8 ror b1,3 286 286 5+n 
, 386 3 
486 2 
RCL reg,immed8 rol bx,5 88/86 — 
RCR reg,immed8& Fer: <si79 286 5+n 
386 9 
486 8-30 
ROL mem,immed8 rol BYTE PTR [bx],10 88/86 — 
ROR mem,immed& ror bits,6 286 8+n 
. 386 ay 
486 4 
RCL mem,immed8 _rcl_ WORD PTR [bp+8], 88/86 — 
RCR mem,immed8_rcr_ masker,3 286 8+n 
386 10 
486 9-31 


* TIT represents one of the following bit codes: 000 for ROL, 001 for ROR, 010 for RCL, or 011 for 
RCR. 


REP Repeat String 


Repeats a string instruction the number of times indicated by CX. First, CX is 
compared to 0; if it equals 0, execution proceeds to the next instruction. Otherwise, 
CX is decremented, the string instruction is performed, and the loop continues. REP 
is used with MOVS and STOS. REP also can be used with INS and OUTS on the 
80186-80486 processors. On all processors except the 80386-80486, combining a 
repeat prefix with a segment override can cause errors if an interrupt occurs. 


Flags No change 


Encoding 


Encoding 


Encoding 


Encoding 


Encoding 


11110011 
Syntax 
REP MOVS dest,src 


REP MOVSSB [[dest,src]] 
REP MOVSW [dest,src] 


1010010w 


REP MOVSD [[dest,src]]* 


11110011 1010101w 


Syntax 


REP STOS dest 
REP STOSB [dest] 
REP STOSW [dest] 
REP STOSD [[dest]]* 


11110011 1010101w 


Syntax 


REP LODS dest 
REP LODSB [dest] 
REP LODSW [dest] 
REP LODSD [[des¢]]* 


11110011 0110110w 


Syntax 


REP INS dest,DX 
REP INSB [[dest,DX]] 
REP INSW [[dest,DX]] 
REP INSD [[dest,DX]|* 


11110011 0110111w 


Syntax 


REP OUTS DX,src 
REP OUTSB [src] 
REP OUTSW [src] 
REP OUTSD [[src]]* 


* 80386-80486 only. 
#Sifn=0, 13 ifn=1. 
T5ifn=0. 


Examples 


rep movs source,dest 
rep movsw 


Examples 


rep stosb 
rep stos dest 


Examples 


rep. lodsb 
rep lods dest 


Examples 


rep insb 
rep ins dest,dx 


Examples 


rep outs dx,source 
rep outsw 


REP Repeat String 121 


§ First protected-mode timing: CPL < IOPL. Second timing: CPL > IOPL. 


Clock Cycles 


9+17n (W88=9+25n) 
5+4n 

7+4n 

124+3n# 


Clock Cycles 


9+10n (WS88=9+14n) 
44+3n 

54+5n 

7+4nt 


Clock Cycles 


7+4nt 


Clock Cycles 


5+4n 
13+6n,pm=(7,27)+6n§ 
16+87,pm=(10,30)+8n 
§ 


Clock Cycles 


5+4n 
12+5n,pm=(6,26)+5n§ 
17+5n,pm=(11,31)+5n§ 
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REPcondition Repeat String Conditionally 


REPcondition Repeat String Conditionally 


Flags 


Encoding 


Encoding 


Encoding 


Repeats a string instruction as long as condition is true and the maximum count has 
not been reached. REPE and REPZ (they are synonyms) repeat while the zero flag 
is set. REPNE and REPNZ (they are synonyms) repeat while the zero flag is 
cleared. The conditional-repeat prefixes should only be used with SCAS and 
CMPS, since these are the only string instructions that modify the zero flag. Before 
executing the instruction, CX should be set to the maximum allowable number of 
repetitions. First, CX is compared to 0; if it equals 0, execution proceeds to the next 
instruction. Otherwise, CX is decremented, the string instruction is performed, and 
the loop continues. On all processors except the 80386-80486, combining a repeat 


prefix with a segment override may cause errors if an interrupt occurs during a 


string operation. 


ODITS ZAPC 


+ 


11110011 1010011w 


Syntax Examples CPU Clock Cycles 
REPE CMPS src,dest repz cmpsb 88/86 9422n (W88&=9+30n) 
REPE CMPSB [src,dest] repe cmps 286 5+9n 

REPE CMPSW [src,dest] src,dest 386 5+9n 

REPE CMPSD [src,dest]]* 486 7+7n# 

11110011 1010111lw 

Syntax Examples CPU —_ Clock Cycles 
REPE SCAS dest repe scas dest 88/86 94+15n (W88=9+19n) 
REPE SCASB [dest] repz scasw 286 54+8n 

REPE SCASW [dest] 386 5+8n 

REPE SCASD [dest]* 486 7+5n# 

11110010 1010011w 

Syntax Examples CPU Clock Cycles 
REPNE CMPS src,dest repne cmpsw 88/86  9+22n (W88=9+30n) 
REPNE CMPSB [src,dest]] repnz cmps 286 5+9n 

REPNE CMPSW [src,dest] src,dest 386 5+9n 

REPNE CMPSD [[src,dest]]* 486 7+7n# 


Encoding 11110010 1010111w 


Syntax 


REPNE SCAS des 
REPNE SCASB [dest] 
REPNE SCASW [dest] 
REPNE SCASD [[dest]]* 


* 80386-80486 only. 
#5 if n=0. 


RET/RETN/RETF 


Examples 


repne scas dest 
repnz scasb 


Return from Procedure 


CPU 


88/86 
286 
386 
486 


RET/RETN/RETF Return from Procedure 


Returns from a procedure by transferring control to an address popped from the top 
of the stack. A constant operand can be given indicating the number of additional 
bytes to release. The constant is normally used to adjust the stack for arguments 
pushed before the procedure was called. The size of a return (near or far) is the size 
of the procedure in which the RET is defined with the PROC directive. RETN can 
be used to specify a near return; RETF can specify a far return. A near return pops 
a word into IP. A far return pops a word into IP and then pops a word into CS. 
After the return, the number of bytes given in the operand (if any) is added to SP. 


Flags No change 

Encoding 11000011 
Syntax Examples 
RET ret 
RETN retn 

Encoding 11000010 data (2) 

| Syntax Examples 

RET immedl6 ret 2 
RETN immedl6 retn 8 


CPU 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


123 


Clock Cycles 


9+15n (W88=9+19n) 
5+8n 

5+81 

7+5n* 


Clock Cycles 


16 (88=20) 
1l+m 
10+m 

5 


Clock Cycles 


20 (88=24) 
ll+m . 
10+m 

5 


124 ROL/ROR Rotate 


Encoding 11001011 
Syntax Examples CPU = Clock Cycles 
RET ret 88/86 26 (88=34) 
RETF retf 286 15+m,pm=25+m,55* 
: 386 18+m,pm=32+m,62* 
486 13,pm=18,33* 
Encoding 11001010 data (2) 
Syntax Examples CPU Clock Cycles 
RET immedl6 ret 8 88/86 25 (88=33) 
RETF immedl6 . retf 32 286 15+m,pm=25+m,55* 


386 18+m,pm=32+m,68* 
486 14,pm=17,33* 


* The first protected-mode timing is for a return to the same privilege level; the second is for a return to 
a lesser privilege level. 


ROL/ROR Rotate 


See RCL/RCR. 


SAHF Store AH into Flags 


Transfers AH into bits 0 to 7 of the flags register. This includes the carry, parity, 
auxiliary carry, zero, and sign flags, but not the trap, interrupt, direction, or 
overflow flags. 


Flags ODI TS ZAPC 
2M aes aes SA 
Encoding 10011110 
Syntax Examples CPU Clock Cycles 
SAHF sahf 88/86 4 
286 2 
386 3 
2 


486 


SBB Subtract with Borrow 125 


SAL/SAR Shift 


See SHL/SHR/SAL/SAR. 


SBB Subtract with Borrow 


Adds the carry flag to the second operand, then subtracts that value from the first 
operand. The result is assigned to the first operand. SBB is used to subtract the 
least significant portions of numbers that must be processed in multiple registers. 


Flags ODITS ZAPC 
zt os: es See 
Encoding 000110dw mod,reg,r/m_ disp (0, 1, or 2) 
Syntax Examples CPU 
SBB reg,reg sbb dx,cx 88/86 
. 286 
386 
| 486 
SBB mem,reg sbb WORD PTR m32[2],dx 88/86 
286 
386 
486 
SBB reg,mem sbb dx,WORD PTR m32[2] 88/86 
286 
386 
486 
Encoding 100000sw mod,011,r/m_ disp (0,1,or2) data(1 or 2) 
Syntax Examples CPU 
SBB reg,immed sbb dx,45 88/86 
286 
386 
486 
SBB mem,immed sbb WORD PTR m32[2],40 88/86 
286 
386 


486 


Clock Cycles 


3 
2 
2 
1 


16+EA (W&8=24+EA) 
7 
6 
3 


9+EA (W88=13+EA) 
7 
7 
2 


Clock Cycles 


4 
3 
2 
1 


17+EA (W88=25+EA) 
y 
a 
3 
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Encoding 


SCAS/SCASB/SCASW/SCASD Scan String Flags 


0001110w data (J or 2) 


Syntax Examples CPU = Clock Cycles 
SBB accum,immed  sbb_ ax,320 88/86 4 

86 3 

386 2 

486 ~=1 


SCAS/SCASB/SCASW/SCASD _ Scan String Flags 


Flags 


Scans a string to find a value specified in the accumulator register. The string to be 
scanned is considered the destination. ES:DI must point to that string, even if an 
operand is specified. For each element, the destination element is subtracted from 
the accumulator value and the flags are updated to reflect the result (although the 
result is not stored). DI is adjusted according to the size of the operands and the 
status of the direction flag. DI is increased if the direction flag has been cleared 
with CLD, or decreased if the direction flag has been set with STD. 


If the SCAS form of the instruction is used, an operand must be provided to indicate 
the size of the data elements to be processed. No segment override is allowed. If 
SCASB (bytes), SCASW (words), or SCASD (doublewords on the 80386-80486 
only) is used, the instruction determines the size of the data elements to be 


| processed and whether the element scanned for is in AL, AX, or EAX. 


SCAS and its variations are normally used with repeat prefixes. REPNE (or 
REPNZ) is used to find the first element in a string that matches the value in the 
accumulator register. REPE (or REPZ) is used to find the first mismatch. Before 
the scan, CX should contain the maximum number of elements to scan. After a 
REPNE SCAS, the zero flag is clear if the string does not contain the accumulator 
value. After a REPE SCAS, the zero flag is set if the string contains nothing but 
the accumulator value. 


When the instruction finishes, ES:DI points to the element that follows (if the 
direction flag is clear) or precedes (if the direction flag is set) the match or 
mismatch. If CX decrements to 0, ES:DI points to the element that follows or 
precedes the last comparison. The zero flag is set or clear according to the result of 
the last comparison, not according to the value of CX. 


ODITS ZAPC 


Encoding 


1010111w 


Syntax 


SCAS [[ES:]] dest 
SCASB [[ES:]] dest] 
SCASW [[ES:]] dest] 
SCASD [[ES:]] dest]|* 


SETcondition Set Conditionally 


Examples 


repne scasw 
repe scasb 
scas es:destin 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


15 (W88=19) 
q 
q 
6 


* 80386-80486 only 


SsETcondition Set Conditionally 


80386-80486 Only Sets the byte specified in the operand to 1 if condition is true or 
to 0 if condition is false. The condition is tested by checking the flags shown in the 
table on the following page. The instruction is used to set Boolean flags 


conditionally. 
Flags No change 
Encoding 00001111 100lcond mod,000,r/m 
Syntax Examples CPU = Clock Cycles 
SET condition reg8 setc dh 88/86 — 
setz al 286 — 
setae bl 386 4 
486 true=4, false=3 
SETcondition mem& seto BTYE PTR [ebx] 88/86 — 
setle flag 286 — 
sete  Booleans[di] 386 5 
486 true=3, false=4 
Set Conditions Opcode Mnemonic Flags Checked _ Description 
10010010 SETB/SETNAE  CF=1 Set if below/not above or equal 
(unsigned comparisons) 
10010011 SETAE/SETNB = CF=0 Set if above or equal/not below 
(unsigned comparisons) 
10010110 SETBE/SETNA = CF=1 or ZF=1 Set if below or equal/not above 
(unsigned comparisons) 
10010111 SETA/SETNBE CF=0and ZF=0 _ Set if above/not below or equal 
(unsigned comparisons) 
10010100 SETE/SETZ ZF=1 Set if equal/zero 
10010101 SETNE/SETNZ ZF=0 Set if not equal/not zero 
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Opcode 
10011100 


10011101 
10011110 
10011111 


10011000 
10011001 
10010010 
10010011 
10010000 
10010001 
10011010 
10011011 


SGDT/SIDT/SLDT 


80286-80486 Only Stores a descriptor table register into a specified operand. 

SGDT stores the Global Descriptor Table; SIDT, the Interrupt Vector Table; and 
SLDT, the Local Descriptor Table. These instructions are generally useful only in 
privileged mode. See Intel documentation for details on descriptor tables and other 
protected-mode concepts. 


Flags 


Encoding 


No change 


SGDT/SIDT/SLDT Store Descriptor Table 


Mnemonic 
SETL/SETNGE 


SETGE/SETNL 
SETLE/SETNG 
SETG/SETNLE 


SETS 

SETNS 

SETC 

SETNC 

SETO 

SETNO 
SETP/SETPE 
SETNP/SETPO 


Flags Checked 
SF_OF 


SF=OF 
ZF=1 or SF_OF 


ZF=0 and 
SF=OF 


SF=1 
SF=0 
F=1 
CF=0 
OF=1 
OF=0 
PF=1 


PF=0 


Description 


Set if less/not greater or equal 
(signed comparisons) 


Set if greater or equal/not less 
(signed comparisons) 


Set if less or equal/not greater or 
equal (signed comparisons) 


Set if greater/not less or equal 
(signed comparisons) 


Set if sign 

Set if not sign 

Set if carry 

Set if not carry 

Set if overflow 

Set if not overflow 

Set if parity/parity even 
Set if no parity/parity odd 


Store Descriptor Table 


00001111 00000001 mod,000,r/m_ disp (2) 


Syntax 
SGDT mem48 


Examples 


sgdt descriptor 


CPU = Clock Cycles 


88/86 — 
286 11 
386 9 


486 10 


Encoding 


Encoding 


SHL/SHR/SAL/SAR Shift 129 


00001111 00000001 mod,001,r/m_ disp (2) 


Syntax . Examples CPU = Clock Cycles 


SIDT mem48 sidt descriptor 88/86 — 
286 12 
386 9 
486 10 


00001111 00000000 mod, 000,r/m disp (0,1, or 2) 


Syntax Examples CPU Clock Cycles 
SLDT regl6 sldt ax 88/86 — . 
286 2 
386 2 
486 2 
SLDT memI16 sldt selector 88/86 — 
286 3 
386 2 
486 3 


SHL/SHR/SAL/SAR = Shift 


Flags 


Shifts the bits in the destination operand the number of times specified by the source 
operand. SAL and SHL shift the bits left; SAR and SHR shift right. 


With SHL, SAL, and SHR, the bit shifted off the end of the operand is copied into 
the carry flag, and the leftmost or rightmost bit opened by the shift is set to 0. With 
SAR, the bit shifted off the end of the operand is copied into the carry flag, and the 
leftmost bit opened by the shift retains its previous value (thus preserving the sign 
of the operand). SAL and SHL are synonyms. 


On the 8088 and 8086, the source operand can be either CL or 1. On the 
80186-80486 processors, the source operand can be CL or an 8-bit constant. On 
the 80186-80486 processors, shift counts larger than 31 are masked off, but on the 
8088 and 8086, larger shift counts are performed despite the inefficiency. Only 
single-bit variations of the instruction modify the overflow flag; for multiple-bit 
variations, the overflow flag is undefined. 


ODI TS ZAPC 
+ ee ee iY es a 
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Encoding 


Encoding 


SHL/SHR/SAL/SAR Shift 


1101000w 


Syntax 
SAR reg,1 


SAL reg,1 
SHL reg,1 
SHR reg,1 
SAR mem,1 


SAL mem,1 
SHL mem,1 
SHR mem,1 


mod,77TT*,1/m_ disp (0, 1, or 2) 


Examples 


sar 
sar 


shr 
shl 
sal 
sar 


sal 
shl 
shr 


di,1 
cl,l 


dh,1 
si,l 
bx,1 
count,1 


WORD PTR m32[@],1 
index,1l 
unsign{diJ,1 


1101001w mod,TTT*,r/m disp (0, 1, or 2) 


Syntax 
SAR reg,CL 


SAL reg,CL 
SHL reg,CL 
SHR reg,CL 


SAR mem,CL 


SAL mem,CL 
SHL mem,CL 
SHR mem,CL 


Examples 


sar 
sar 


shr 
shl 
sal 


sar 


sar 


shr 
sal 
shl 


bx,cl 
dx,cl 


dx,cl 
di,cl 
ah,cl 


sign,cl 


WORD PTR [bp+8],cl 


WORD PTR m32[2],cl 
BYTE PTR [Edi],cl 
index,cl 


Clock Cycles 


S+EA (W88=23+EA) 


5+EA (W88=23+EA) 


ANA RAIA WWNND WWNHN LD 


Clock Cycles 


8+4n 
5+n 


20+EA+4n 
(W88=28+EA+4n) 
8+n 

7 

4 


20+EA+4n 
(W88=28+EA+4n) 
8+n 

fs 


Encoding 


SHLD/SHRD Double Precision Shift 


Flags 


SHLD/SHRD Double Precision Shift 131 


1100000w mod,TTT*,r/m_ disp (0,1,o0r2) data(1) 


Syntax 
SAR reg,immed8& 


SAL reg,immed8& 
SHL reg,immed8 
SHR reg,immeds 


SAR mem,immed8 


SAL reg,immed8& 
SHL reg,immed8s 
SHR reg,immed8& 


Examples 


sar 
sar 


sal 
shl 
shr 


sar 
sar 


shr 
shl 
sal 


bx,5 
cl,5 


cx,6 
di,2 
bx,8 


sign_count,3 
WORD PTR [bx],5 


meml6,11 
unsign,4 
array[bx+di],14 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


5+n 


* TTT represents one of the following bit codes: 100 for SHL or SAL, 101 for SHR, or 111 for SAR. 


80386-80486 Only Shifts the bits of the second operand into the first operand. The 
number of bits shifted is specified by the third operand. SHLD shifts the first 
operand to the left by the number of positions specified in the count. The positions 
opened by the shift are filled by the most significant bits of the second operand. 
SHRD shifts the first operand to the right by the number of positions specified in 
the count. The positions opened by the shift are filled by the least significant bits of 
the second operand. The count operand can be either CL or an 8-bit constant. If a 
shift count larger than 31 is given, it is adjusted by using the remainder (modulo) of 


a division by 32. 
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Encoding 


Encoding 


Encoding 


SHLD/SHRD Double Precision Shift 


00001111 10100100 mod,reg,r/m disp (0,1,or2) data (1) 


Syntax Examples CPU 
SHLD reg/6,reg16,immed8 shld ax,dx,10 88/86 
SHLD reg32,reg32,immed8 286 
386 
486 
SHLD meml6,regl6,immed8 = shld _ .bits,cx,5 88/86 
SHLD mem32,reg32,immed8 286 
386 
A86 


Clock Cycles 


ae 
Z 


7 
3 


00001111 10101100 mod,reg,r/m disp (0,1,or2) data (1) 


Syntax — Examples CPU 
SHRD reg16,reg16,immed& shrd cx,si,3 88/86 
SHRD reg32,reg32,immed8& 286 
386 
486 
SHRD meml6,regl6,immed8 ~~ shrd_ [di],dx,13 88/86 
SHRD mem32,reg32,immed8& 286 
386 
486 


00001111 10100101 mod,reg,r/m_ disp (0, 1, or 2) 


Syntax Examples CPU 
SHLD reg/6,reg16,CL shld ax,dx,cl 88/86 
SHLD reg32,reg32,CL 286 
386 
486 
SHLD meml16,reg16,CL shld 88/86 
SHLD mem32,reg32,CL masker,ax,cl 286 
386 


486 


Clock Cycles 


SMSW Store Machine Status Word 133 


Encoding 00001111 10101101 mod,reg,rim disp (0, 1, or 2) 


Syntax Examples CPU 
SHRD reg/6,reg16,CL shrd bx,dx,cl 88/86 
SHRD reg32,reg32,CL 286 
386 
486 
SHRD mem16,reg16,CL shrd [bx],dx,cl 88/86 
SHRD mem32,reg32,CL 286 
386 
486 


SMSW Store Machine Status Word 


Clock Cycles 


80286-80486 Only Stores the Machine Status Word (MSW) into a specified 
memory operand. SMSW is generally useful only in protected mode. See Intel 
documentation for details on the MSW and other protected-mode concepts. 


Flags | No change 

Encoding 00001111 00000001 mod,100,r/m_ disp (0, 1, or 2) 
Syntax Examples CPU 
SMSW regl6 SmSW aX 88/86 

286 

386 

486 
SMSW meml6 smsw machine 88/86 

286 

386 


486 


Clock Cycles 


ee 


ae 


134 STC Set Carry Flag 


STC Set Carry Flag 


Sets the carry flag. 
Flags ODI TS ZAPC 
1 
Encoding 11111001 
Syntax Examples CPU = _ Clock Cycles 
STC stc 88/86 2 
286 2 
386 2 
486 2 


STD Set Direction Flag 


Sets the direction flag. All subsequent string instructions will process down (from 
high addresses to low addresses). 


Flags ODITS ZAPC 
a 
Encoding 11111101 
Syntax Examples CPU = Clock Cycles 
STD std 88/86 2 
286 2 
386 2 
486 Z 


ST! Set Interrupt Flag | 


Sets the interrupt flag. When the interrupt flag is set, maskable interrupts are 
recognized. If interrupts were disabled by a previous CLI instruction, pending 
interrupts will not be executed immediately; they will be executed after the 
instruction following STI. 


Flags ODITSZAPC 
1 


Encoding 


STOS/STOSB/STOSW/STOSD Store String Data 135 


11111011 
Syntax Examples CPU —_ Clock Cycles 
STI sti 88/86 2 

286 2 

386 3 

486 5 


STOS/STOSB/STOSW/STOSD Store String Data 


Flags 


Encoding 


Stores the value of the accumulator in a string. The string is the destination and 
must be pointed to by ES:DI, even if an operand is given. For each source element 
loaded, DI is adjusted according to the size of the operand and the status of the 


. direction flag. DI is incremented if the direction flag has been cleared with CLD or 


decremented if the direction flag has been set with STD. 


If the STOS form of the instruction is used, an operand must be provided to indicate 
the size of the data elements to be processed. No segment override is allowed. If 
STOSB (bytes), STOSW (words), or STOSD (doublewords on the 80386-80486 
only) is used, the instruction determines the size of the data elements to be 
processed and whether the element comes from AL, AX, or EAX. 


STOS and its variations are often used with the REP prefix to fill a string with a 
repeated value. Before the repeated instruction is executed, CX should contain the 
number of elements to store. 


No change 

1010101w 

Syntax Examples CPU Clock Cycles 
STOS [[ES:]] dest stos es:dstring 88/86 11 (W88=15) 
STOSB [[ES:]] desz]] rep stosw 286 3 

STOSW [[ES:]] dest] rep stosb 386 4 

STOSD [[ES:]] dest]]|* 486 > 


* 80386-80486 only 
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STR Store Task Register 


STR Store Task Register 


Flags 
Encoding 


80286-80486 Only Stores the current task register to the specified operand. This 
instruction is generally useful only in privileged mode. See Intel documentation for 
details on task registers and other protected-mode concepts. 


No change 
00001111 O0000000 mod,001,reg_ disp (0,1, or 2) 


Syntax Examples ~ CPU — Clock Cycles 
STR regl6 str cx 88/86 

286 2 

386 Z 

486 2 
STR meml6 str taskreg 88/86 — 

286 3 

386 2 

486 3 


SUB Subtract 


Flags 


Encoding 


Subtracts the source operand from the destination operand and stores the result in 
the destination operand. 


ODITS ZAPC 
+ tte 44 


001010dw mod,reg,r/m_ disp (0,1, or 2). 


Syntax Examples CPU Clock Cycles 
SUB reg,reg sub ax,bx 88/86 3 
sub bh,dh 286 2 
386 2 
486 1 
SUB mem,reg sub tally,bx 88/86  16+EA (W88=24+EA) 
sub array[di],bl 286 7 
386 6 


486 3 


TEST Logical Compare 137 


Syntax Examples CPU —_ Clock Cycles 
SUB reg,mem sub cx,discard 88/86 9+EA (W88=13+EA) 
sub al,[bx] 286 7 
386 i 
486 2 
Encoding 100000sw mod,101,r/m disp (0,1, o0r2) data(l or 2) 
Syntax Examples CPU = _ Clock Cycles 
SUB reg,immed sub dx,45 88/86 4 
sub bl,7 286 3 
386 2 
486 1 
SUB mem,inumed sub total,4000 88/86 17+EA (W88=25+EA) 
sub BYTE PTR [bx+di],2 286 7 
386 7 
486 3 
Encoding 0010110w data (I or 2) 
| Syntax . Examples CPU = Clock Cycles 
SUB accum,immed sub ax,32000 88/86 4 
286 3 
386 2 
486 1 


TEST Logical Compare 


Tests specified bits of an operand and sets the flags for a subsequent conditional 
jump or set instruction. One of the operands contains the value to be tested. The 
other contains a bit mask indicating the bits to be tested. TEST works by doing a 
bitwise AND operation on the source and destination operands. The flags are 
modified according to the result, but the destination operand is not changed. This 
instruction is the same as the AND instruction, except the result is not stored. 


Flags — ODITSZAPC 
0 cage ae ae am 


138 VERR/VERW Verify Read or Write 


Encoding 1000010w mod,reg,r/m_ disp (0,1, or 2) 
Syntax Examples CPU Clock Cycles 
TEST reg,reg test dx,bx 88/86 3 
test bl,ch 286 2 
386 2 
486 1 
TEST mem,reg test dx,flags 88/86 9+EA (W88=13+EA) 
TEST reg,mem* test bl,bitarray[bx] 286 6 
386 5 
486 2 
Encoding 1111011w mod,000,r/m_ disp (0,1,o0r2) data (I or 2) 
Syntax Examples CPU = _ Clock Cycles 
TEST reg,immed test cx,3Qh 88/86 5 
test cl,1011b 286 3 
386 2 
486 1 
TEST mem,immed test masker,1 88/86 11+EA 
test BYTE PTR [bx],03h 286 6 
386 5 
486 py 
Encoding 1010100w data (J or 2) 
Syntax Examples CPU Clock Cycles 
TEST test ax,90h 88/86 4 
accum,immed 286 3 
386 2 
486 1 


* MASM transposes TEST reg,mem; that is, it is encoded as TEST mem,reg. 


VERR/VERW Verify Read or Write 


80286-80486 Protected Only Verifies that a specified segment selector is valid and 
can be read or written to at the current privilege level. VERR verifies that the 
selector is readable. VERW verifies that the selector can be written to. If the 
segment is verified, the zero flag is set. Otherwise, the zero flag is cleared. 


Flags ODITSZAPC 
+ 


WAIT Wait 139 


Encoding 00001111 00000000 mod, 100,r/m_ disp (0, 1, or 2) 
Syntax Examples CPU = Clock Cycles 
VERR regl6 verr ax 88/86 — 
286 14 
386 10 
486 11 
VERR mem16 verr selector 88/86 — 
286 16 
386 11 
486 11 
Encoding 00001111 00000000 mod,101,r/m_ disp (0, 1, or 2) 
Syntax Examples CPU —_ Clock Cycles 
VERW regl6 verw cx 88/86 — 
286 14 
386 15 
486 11 
VERW meml6 verw selector 88/86 — 
286 16 
386 16 
486 11 


WAIT Wait 


Suspends processor execution until the processor receives a signal that a 

coprocessor has finished a simultaneous operation. It should be used to prevent a 
coprocessor instruction from modifying a memory location that is being modified 
simultaneously by a processor instruction. WAIT is the same as the coprocessor 


FWAIT instruction. 
Flags No change 
Encoding 10011011 
Syntax Examples CPU —_ Clock Cycles 
WAIT | wait 88/86 4 
286 3 
386 6 


486 1-3 


140 WBINVD Write Back and Invalidate Data Cache 


WBINVD Write Back and Invalidate Data Cache 


80486 Only Empties the contents of the current data cache after writing changes to 
memory. Proper use of this instruction requires knowledge of how contents are 
placed in the cache. WBINVD is intended primarily for system programming. See 
Intel documentation for details. 


Flags No change 
Encoding 00001111 00001001 
Syntax Examples CPU = Clock Cycles 
WBINVD wbinvd 88/86 — 
286 — 
386 — 
486 5 


XADD Exchange and Add 


80486 Only Adds the source and destination operands and stores the sum in the 
destination; simultaneously, the original value of the destination is moved to the 
source. The instruction sets flags according to the result of the addition. 


Flags ODI TS ZAPC 
a0 ie ie SA ee 2 
Encoding 00001111 1100000b mod, reg,r/m_ disp (0, 1, or 2) 
Syntax Examples CPU = Clock Cycles 
XADD mem,reg xadd warr[bx],ax 88/86 — 
xadd string,bl 286 — 
386 — 
486 4 
XADD reg,reg xadd dl,al 88/86 — 
xadd bx,dx 286 — 
386 — 


486 3 


XLAT/XLATB Translate 141 


XCHG Exchange 


Exchanges the values of the source and destination operands. 


Flags No change 
Encoding 1000011w mod,reg,r/m disp (0, 1, or 2) 
Syntax Examples CPU = Clock Cycles 
XCHG reg,reg xchg cx,dx 88/86 4 
xchg bl,dh 286 3 
xchg al,ah 386 3 
486 3 
XCHG reg,mem xchg [bx],ax 88/86 17+EA (W88=25+EA) 
XCHG mem,reg xchg bx,pointer 286 5 
386 5 
486 5 
_ Encoding 10010 reg 
Syntax Examples CPU Clock Cycles 
XCHG accum,regl6*  xchg ax,cx 88/86 3 
XCHG regl6,accum* xchg cx,ax 286 3 
386 3 
486 3 


* On the 80386-80486, the accumulator may also be exchanged with a 32-bit register. 


XLAT/XLATB Translate 


Translates a value from one coding system to another by looking up the value to be 
translated in a table stored in memory. Before the instruction is executed, BX 
should point to a table in memory and AL should contain the unsigned position of 
the value to be translated from the table. After the instruction, AL contains the table 
value at the specified position. No operand is required, but one can be given to 
specify a segment override. DS is assumed unless a segment override is given. 
XLATB is a synonym for XLAT. Either version allows an operand, but neither 
requires one. 
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Flags 


Encoding 


XOR_ Exclusive OR 


No change 
11010111 


Syntax 


XLAT [[[segreg:]] mem] 
XLATB [[[segreg:]] mem] 


XOR_ Exclusive OR 


Performs a bitwise exclusive OR operation on the source and destination operands 
and stores the result in the destination. For each bit position in the operands, if both 
bits are set or if both bits are cleared, the corresponding bit of the result is cleared. 


Flags 


Encoding 


Otherwise, the corresponding bit of the result is set. 


Examples 


Xlat 
Xlatb es:table 


ODI TS ZAPC 
0 fy td by Se 0) 


001100dw mod,reg,r/m_ disp (0,1, or 2) 


Syntax Examples 
XOR reg,reg xor cx,bx 
xor ah,al 
XOR mem,reg xor [bp+10],cx 
xor masked,bx 
XOR reg,mem xor cx,flags 


xor 


bl,bitarray[di] 


CPU 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


Clock Cycles 


mel 
5 
5 
4 


Clock Cycles 


3 
2 
2 
1 


16+EA (W88=24+EA) 
7 
6 
3 


9+EA (W&8=13+EA) 
7 
7 
2 


Encoding 


Encoding 


100000sw = mod,110,r/m disp (0,1,or2) data (1 or 2) 


Syntax Examples 

XOR reg,immed xor bx,10h 
xor bl,1 

XOR mem,immed xor Boolean,1 


xor switches[bx],101b 


0011010w data (Jl or 2) 


Syntax Examples | 


XOR accum,immed xor ax,01010101b 
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CPU 


88/86 
286 
386 
486 


88/86 
286 
386 
486 


CPU 


88/86 
286 
386 
486 


Clock Cycles 


4 
3 
2: 
1 


17+EA (W88=25+EA) 
7 
7 
3 


Clock Cycles 
4 


3 
2 
1 
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Reference 


Arithmetic 
FABS 


FCHS 
FDIVR/FIDIVR 
FMULP 
FRNDINT 
FSUB/FISUB 
FSUBRP 


Compare 
FCOM/FICOM 


FSTSW/FNSTSW 
FUCOMPs 


Load 
FLD/FILD/FBLD 
FRSTOR 


Load Constant 
FLD1 


FLDLG2 
FLDZ 


Processor Control 
FCLEX/FNCLEX 


FENI/FNENI* 
FINIT/FNINIT 
FRSTOR 
FSTCW/FNSTCW 
FWAIT 


Store Data 
FSAVE/FNSAVE 


FSTENV/FNSTENV 


FADD/FIADD 
FDIV/FIDIV 
FDIVRP 
FPREM 
FSCALE 
FSUBP 
FXTRACT 


FCOMP/FICOMP 
FIST 
FUCOMPPs 


FLDCW 
FXCH 


FLDL2E 
FLDLN2 


FDECSTP 

FFREE 

FLDCW 
FSAVE/FNSAVE 
FSTENV/FNSTENV 


FST/FIST 
FSTP/FISTP/FBSTP 


Topical Cross-reference for Coprocessor Instructions 


FADDP 

FDIVP 
FMUL/FIMUL 
FPREMI: 
FSQRT 
FSUBR/FISUBR 


FCOMPP 
FUCOMs 
FXAM 


FLDENV 


FLDL2T 
FLDPI 


FDISI/FNDISI* 
FINCSTP 

FNOP 

FSETPM_ 
FSTSW/ENSTSW 


FSTCW/FNSTCW 
FSTSW/FNSTSW 


Coprocessor 


Transcendental | 

F2XM1 FCOSs FPATAN 
FPREM FPREMIs_ FPTAN 
FSINs FSINCOSs FYL2P1 
FYL2X 


* 8087 only + 80287 only. § 80387-80486 only. 
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Interpreting Coprocessor Instructions 


This section provides an alphabetical reference to instructions of the 8087, 80287, 
and 80387 coprocessors. The format is the same as the processor instructions 
except that encodings are not provided. Differences are noted in the following. 


The 80486 has the coprocessor built in. This one chip executes all the instructions 
listed in the previous section and this section. 


Syntax | 

Syntaxes in Column 1 use the following abbreviations for operand types: 
Syntax Operand 

reg A coprocessor stack register 

memreal A direct or indirect memory operand storing a real number 
memint A direct or indirect memory operand storing a binary integer 
membcd A direct or indirect memory operand storing a BCD number 
Examples 

The position of the examples in Column 2 is not related to the clock speeds in 
Column 3. 

Clock Speeds 


Column 3 shows the clock speeds for each processor. Sometimes an instruction may 
have more than one possible clock speed. The following abbreviations are used to 
specify variations: 


Abbreviation Description 


EA Effective address. This applies only to the 8087. See the Processor 
Section, “Timings on the 8088 and 8086 Processors,” for an explanation 
of effective address timings. 


Slt Short real, long real, and 10-byte temporary real. 
w,d,q Word, doubleword, and quadword binary integer. 
to, fr To or from stack top. On the 80387 and 80486, the to clocks represent 


timings when ST is the destination. The fr clocks represent timings when 
ST is the source. 


Instruction Size 

The instruction size is always 2 bytes for instructions that do not access memory. 
For instructions that do access memory, the size is 4 bytes on the 8087 and 80287. 
On the 80387 and 80486, the size for instructions that access memory is 4 bytes in 
16-bit mode, or 6 bytes in 32-bit mode. 
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On the 8087, each instruction must be preceded by the WAIT (also called FWAIT) 
instruction, thereby increasing the instruction’s size by 1 byte. The assembler 
inserts WAIT automatically by default, or with the .8087 directive. 


Architecture 


The 8087, 80287, and 80387 coprocessors, along with the 80486, have several 
common elements of architecture. All have a register stack made up of eight 80-bit 
data registers. These can contain floating-point numbers in the temporary real 
format. The coprocessors also have 14 bytes of control registers. Figure 5.1 shows 
the format of registers. 


Coprocessor Data Registers 


ST 

ST(1) 
ST(2) 
ST(3) 
ST(4) 
ST(5) 
ST(6) 
ST(7) 


si | Exponent | Decimal part 


Control Registers 


Instruction Pointer 


aoe Operand Pointer 


Fig. 5.1 Coprocessor Registers 


150 F2XM1 2X-1 


The most important control registers are the control word and the status word. 
Figure 5.2 shows the format of these registers. 


Control Word 


Se 
fx x fio wo FO [ie | [rwfunfoufzn fou w | 


Status Word 


je SS SS 
fe fos st [oefcr[ oo [es[se[re[ue[oe[ze [vel 


Fig. 5.2 Control Word and Status Word 


F2XM1 2*-1 


Calculates Y = 2% — 1. X is taken from ST. The result, Y, is returned in ST. X must 
be in the range 0 < X < 0.5 on the 8087/287, or in the range —1.0 < X < +1.0 on the 
80387-80486. 


Syntax Examples CPU = Clock Cycles 


F2XM1 f2xm1 87 310-630 
287 310-630 
387 211-476 
486 140-279 


FABS Absolute Value 


Converts the element in ST to its absolute value. 


Syntax Examples CPU = Clock Cycles 
FABS fabs 87 ~—- 10-17 

287 10-17 

387 22 


486 &) 


FADD/FADDP/FIADD Add 


Adds the source to the destination and returns the sum in the destination. If two 
register operands are specified, one must be ST. If a memory operand is specified, 
the sum replaces the value in ST. Memory operands can be 32- or 64-bit real 
numbers or 16- or 32-bit integers. If no operand is specified, ST is added to ST(1) 
and the stack is popped, returning the sum in ST. For FADDP, the source must be 


ST; the sum is returned in the destination and ST is popped. 


Syntax 
FADD [reg,reg] 


FADDP reg,ST 


FADD memreal 


FIADD memint 


FBLD Load BCD 


See FLD. 


Examples 


fadd st,st(2)- 
fadd st(5),st 
fadd 


faddp st(6),st 


fadd QWORD PTR [bx] 
fadd shortreal 


fiadd intl6 
fiadd warray[di] 
fiadd double 


-FBSTP Store BCD and Pop 


See FST. 


FBSTP StoreBCDandPop = 151 


CPU 


87 

287 
387 
486 


87 

287 
387 
486 


87 


287 
387 
486 


87 


287 


387 
486 


Clock Cycles 


70-100 

70-100 

to=23-31, fr=26-34 
8-20 


75-105 
75-105 
23-31 
8-20 


(s=90—120,s=95—125) 
+EA 
s=90—120,/=95-—125 
$=24-32./=99-37 
8-20 


(w=102-137,d=108 
—143)+EA 
w=102-137,d=108 - 
~143 
w=71-85,d=57-72 
w=20-35,d=19-32 


152 FCHS Change Sign 


FCHS Change Sign 


Reverses the sign of the value in ST. 


Syntax Examples CPU = _ Clock Cycles 
FCHS fchs 87 10-17 

287 10-17 

387 24-25 

486 6 


FCLEX/FNCLEX Clear Exceptions 


Clears all exception flags, the busy flag, and bit 7 in the status word. Bit 7 is the 
interrupt-request flag on the 8087, and the error-status flag on the 80287, 80387, 
and 80486. The instruction has wait and no-wait versions. 


Syntax Examples CPU _ Clock Cycles* 
FCLEX fclex 87 2-8 
FNCLEX 287 2-8 

387 11 

486 7 


* These timings reflect the no-wait version of the instruction. The wait version may take additional 
clock cycles. 


FCOM/FCOMP/FCOMPP/FICOM/FICOMP Compare 


Compares the specified source operand to ST and sets the condition codes of the 
status word according to the result. The instruction subtracts the source operand 
from ST without changing either operand. Memory operands can be 32- or 64-bit 
real numbers or 16- or 32-bit integers. If no operand is specified or if two pops are 
specified, ST is compared to ST(1) and the stack is popped. If one pop is specified 
with an operand, the operand is compared to ST. If one of the operands is a NAN, 
an invalid-operation exception occurs (see FUCOM for an alternative method of 
comparing on the 80387-80486). 


Syntax 
FCOM [reg] 


FCOMP [reg] 


FCOMPP 


FCOM memreal 


FCOMP memreal 


FICOM memint 


FICOMP memint 


FCOM/FCOMP/FCOMPP/FICOM/FICOMP Compare 153 


Examples 


fcom 
fcom 


fcomp 
fcomp 


fcompp 


fcom 
fcom 


fcomp 
fcomp 


ficom 
ficom 


ficomp 
[bp+6] 
ficomp 


Condition Codes for FCOM 


C3 C2 
0 0 
0 0 
1 0 
1 1 


Cl 


QQ wD 


st(2) 


st(7) 


shortreals[di] 
longreal 


longreal 
shorts[di] 


double 
warray[di] 


WORD PTR 


darray[di] 


- OF © 


CPU 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


87 
287 


387 
486 


87 
287 


387 
486 


Meaning 
ST > source 
ST < source 


ST = source 


Clock Cycles 


40-50 
40-50 
24 


(s=60—-70,/=65—-75)+EA 
s=60-70,/=65-—75 
s=26,/=31 

4 


(s=63-—73 ,/=67—77)+EA 
s=63-73,/=67—77 
s=26,/=31 

4 


(w=72-86,d=78-91)+EA 
w=72-86,d=78-9 | 
w=7 1-75 ,d=56—63 
w=16-20,d=15-17 


(w=74-88 d=80-93)+EA 
w=74-88,d=80—-93 
w=71—75,d=56-63 
w=16-20,d=15-17 


ST is not comparable to source 
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FCOS Cosine 


— 80387-80486 Only Replaces a value in radians in ST with its cosine. If |ST| < 263, 
the C2 bit of the status word is cleared and the cosine is calculated. Otherwise, C2 
is set and no calculation is performed. ST can be reduced to the required range with 


FPREM or FPREM1. 
Syntax Examples — CPU Clock Cycles 
FCOS fcos 87 — 


287 — 
387 123-772* 
486 257-3547 


* For operands with an absolute value greater than 1/4, up to 76 additional clocks may be required. 


+ For operands with an absolute value greater than 7/4, add n clocks where n = operand|(n/4). 


FDECSTP Decrement Stack Pointer 


Decrements the stack-top pointer in the status word. No tags or registers are 
changed, and no data is transferred. If the stack pointer is 0, FDECSTP changes 


it to 7. 
Syntax Examples CPU = _ Clock Cycles 
FDECSTP fdecstp 87 6-12 
287 6-12 
387 Zz 
486 3 


FDISI/FNDISI Disable Interrupts 


8087 Only Disables interrupts by setting the interrupt-enable mask in the control 
word. This instruction has wait and no-wait versions. Since the 80287, 80387, and 
80486 do not have an interrupt-enable mask, the instruction is recognized but 
ignored on these coprocessors. 


Syntax Examples 
FDISI fdisi 
FNDISI 


FDIV/FDIVP/FIDIV Divide 155 


CPU 


87 

287 
387 
486 


Clock Cycles* 


2-8 
2 


2 
3 


* These timings reflect the no-wait version of the instruction. The wait version may take additional 


clock cycles. 


FDIV/FDIVP/FIDIV Divide 


Divides the destination by the source and returns the quotient in the destination. 
If two register operands are specified, one must be ST. If a memory operand is 
specified, the quotient replaces the value in ST. Memory operands can be 32- or 
64-bit real numbers or 16- or 32-bit integers. If no operand is specified, ST(1) is 
divided by ST and the stack is popped, returning the result in ST. For FDIVP, 
the source must be ST; the quotient is returned in the destination register and ST 


is popped. 
Syntax Examples 
FDIV [reg,reg]] fdiv st,st(2) 
fdiv .st(5),st 
FDIVP reg,ST fdivp st(6),st 
FDIV memreal fdiv  DWORD PTR [bx] 
fdiv shortreal[di] 
fdiv longreal 
FIDIV memint fidiv intl16 
fidiv warray[di] 
fidiv double 


CPU 


Clock Cycles 


193-203 
193-203 
to=88, fr=91- 
73 


197-207 


(s=2 15-225 J=220- 

230)+EA 

s=215-—225 ,J=220-230 
=89 ,/=94 

73 


(w=224—238 ,d=230- 
243)+EA 
w=224—238,d=230 
—243 
w=136—140,d=120 
—127 

w=85-89 ,d=84—86 


156 FDIVR/FDIVRP/FIDIVR Divide Reversed 


FDIVR/FDIVRP/FIDIVR Divide Reversed 


Divides the source by the destination and returns the quotient in the destination. If 
two register operands are specified, one must be ST. If a memory operand is 
specified, the quotient replaces the value in ST. Memory operands can be 32- or 64- 
bit real numbers or 16- or 32-bit integers. If no operand is specified, ST is divided 
by ST(1) and the stack is popped, returning the result in ST. For FDIVRP, the 
source must be ST; the quotient is returned in the destination register and ST is 


popped. 
Syntax Examples CPU = Clock Cycles 
FDIVR [[reg,reg]] fdivr st,st(2) 87 194-204 
fdivr st(5),st 287 194-204 
fdivr 387 to=88, fr=91 
486 73 
FDIVRP reg,ST fdivrp st(6),st 87 198-208 
287 198-208 
387 91 
486 73 
FDIVR memreal fdivr longreal 87 (s=216—226,/=221 
fdivr shortreal[di] —231)+EA 
287 s=216-226,/=221-231 
387 s=89 1=94 
| 486 73 
FIDIVR memint fidivr double 87 (w=225-239,d=231 
fidivr warray[{di] —245)+EA 
287 w=225-239,d=231 
—245 


387 w=135—141,d=121-128 
486 w=85-89 d=84-86 


FENI/FNENI Enable Interrupts 


8087 Only Enables interrupts by clearing the interrupt-enable mask in the control 
word. This instruction has wait and no-wait versions. Since the 80287, 80387, and 
80486 do not have interrupt-enable masks, the instruction is recognized but ignored 
on these coprocessors. . 


FILD LoadInteger 157 


Syntax Examples CPU = Clock Cycles* 
FENI feni 87 2-8 
FNENI ’ 287 2 

387 2 

486 3 


* These timings reflect the no-wait version of the instruction. The wait version may take additional 
clock cycles. 


FFREE Free Register 


Changes the specified register’s tag to empty without changing the contents of the 


register. 
Syntax Examples . CPU Clock Cycles 
FFREE ST(i) ffree st(3) 87 9-16 

287 9-16 

387 18 

486 3 


FIADD/FISUB/FISUBR/ 
FIMUL/FIDIV/FIDIVR — Integer Arithmetic 


See FADD, FSUB, FSUBR, FMUL, FDIV, and FDIVR. 


FICOM/FICOMP Compare Integer 


See FCOM. 


FILD Load Integer 


See FLD. 


158 FINCSTP Increment Stack Pointer 


FINCSTP Increment Stack Pointer 


Increments the stack-top pointer in the status word. No tags or registers are 
changed, and no data is transferred. If the stack pointer is 7, FINCSTP changes it 


to 0. 
Syntax Examples CPU Clock Cycles 
FINCSTP fincstp 87 6-12 

287 6-12 

387 | 

486 3 


FINIT/FNINIT Initialize Coprocessor 


Initializes the coprocessor and resets all the registers and flags to their default 
values. The instruction has wait and no-wait versions. On the 80387-80486, the 
condition codes of the status word are cleared. On the 8087/287, they are 


unchanged. 
Syntax Examples CPU —_ Clock Cycles* 
FINIT finit 87 2-8 
FNINIT 287 2-8 
387: =: 33 
486 17 


* These timings reflect the no-wait version of the instruction. The wait version may take additional 
clock cycles. 


FIST/FISTP Store Integer 


See FST. 


FLD1/FLDZ/FLDPI/FLDL2E/FLDL2T/FLDLG2/FLDLN2 Load Constant 159 


FLD/FILD/FBLD Load 


Pushes the specified operand onto the stack. All memory operands are automatically 
converted to temporary-real numbers before being loaded. Memory operands can be 
32-, 64-, or 80-bit real numbers or 16-, 32-, or 64-bit integers. 


Syntax Examples CPU 
FLD reg fld st(3) 87 
287 
387 
486 
FLD memreal fld  longreal 87 
fld shortarray[bx+di] 
287 
fld tempreal 
387 
486 
FILD memint fild meml6 87 
fild DWORD PTR [bx] 
fild quads[si] 287 
387 
486 
FBLD membcd fbld packbcd 87 
287 
387 
486 


FLD1/FLDZ/FLDPI/FLDL2E/ 
FLDL2T/FLDLG2/FLDLN2 Load Constant 


Pushes a constant onto the stack. The following constants can be loaded: 


Instruction 
FLD1 
FLDZ 
FLDPI 


Constant 
+1.0 
+0.0 


T 


Clock Cycles 


17-22 
19-22 
14 

4 


(s=38—56,/=40-60,t= 
53-65)+EA 
s=38—56,/=40-60,t= 
53-65 
s=20,/=25,t=44 
s=3,/=3,t=6 


(w=46-54,d=52-60,q= 
60-68)+EA 
w=46-54,d=52-60,g= 
60-68 
w=61-65,d=45-52,q= 
56-67 
w=13-16,d=9-12,q= 
10-18 


(290-3 10)+EA 
290-310 
266-275 
70-103 


160 


Instruction 


FLDL2E 
FLDL2T 
FLDLG2 
FLDLN2 


Syntax 
FLD1 


FLDZ 


FLDPI 


FLDL2E 


FLDL2T 


FLDLG2 


FLDLN2 


FLD1/FLDZ/FLDPI/FLDL2E/FLDL2T/FLDLG2/FLDLN2 Load Constant 


Constant 
Log2(e) 
Log?(10) 
Log10(2) 
Loge(2) 


Examples 


fldl 


fldz 


fldpi 


fldi2e 


fldi2t 


fldig2 


fldin2 


-CPU 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


87 

287 
387 
486 


Clock Cycles 


15-21 
15-21 
24 


FMUL/FMULP/FIMUL Multiply 161 


FLDCW Load Control Word 


Loads the specified word into the coprocessor control word. The format of the 
control word is shown in the “Interpreting Coprocessor Instructions” section. 


Syntax Examples CPU = _ Clock Cycles 
FLDCW meml6 fldcw ctrilword 87 (7-14)+EA 
287 7-14 
387 19 
486 4 


FLDENV/FLDENVW/FLDENVD 
Load Environment State 


Loads the 14-byte coprocessor environment state from a specified memory location. 
The environment includes the control word, status word, tag word, instruction 
pointer, and operand pointer. On the 80387-80486 in 32-bit mode, the environment 
state is 28 bytes. | 


Syntax Examples CPU Clock Cycles 
FLDENV mem fldenv [bp+10] 87 (35-45)+EA 
FLDENVW mem* 287 35-45 — 
FLDENVD mem* 387 ral 


486  44,pm=34 


* 80387-80486 only. 


FMUL/FMULP/FIMUL Multiply 


Multiplies the source by the destination and returns the product in the destination. If 
two register operands are specified, one must be ST. If a memory operand is 
specified, the product replaces the value in ST. Memory operands can be 32- or 64- 
bit real numbers or 16- or 32-bit integers. If no operand is specified, ST(1) is 
multiplied by ST and the stack is popped, returning the product in ST. For FMULP, 
the source must be ST; the product is returned in the destination register and ST is 


popped. 


162 FNinstruction No-Wait Instructions 


Syntax Examples CPU Clock Cycles 
FMUL [reg,reg]] fmul st,st(2) 87 130-145 (90-105)* 
fmul st(5),st 287 130-145 (90-105)* 
fmul 387 to=46—54 (49), fr= 
29-57 (52)7 
486 16 
FMULP reg,ST fmulp st(6),st 87 134-148 (94—-108)* 


287 134-148 (94-108)* 
387 29-57 (52)7 


486 16 
FMUL memreal fmul DWORD PTR [bx] 87 (s=110—125,/=154— 
fmul = shortreal[di+3] 168)+EA§ 
fmul longreal 287 s=110—125,/=154 
—168§ 


387 s=27-35 ,l=32-57 
486 s=11,/-14 


FIMUL memint fimul intl6 87 (w=124—138,d=130 
fimul warray[di] —144)+EA 
fimul double 287 w=124—138,d=130 
—144 


387 w=76-87 ,d=6 1-82 
486 w=23-27 ,d=22-24 


* The clocks in parentheses show times for short values—those with 40 trailing zeros in their fraction 
because they were loaded from a short-real memory operand. 

+ The clocks in parentheses show typical speeds. 

§ If the register operand is a short value—having 40 trailing zeros in its fraction because it was loaded 


from a short-real memory operand—then the timing is (112—126)+EA on the 8087 or 112-126 on 
the 80287. 


FNinstruction No-Wait Instructions 


Instructions that have no-wait versions include FCLEX, FDISI, FENI, FINIT, 
FSAVE, FSTCW, FSTENV, and FSTSW. Wait versions of instructions check for 
unmasked numeric errors; no-wait versions do not. When the .8087 directive is 
used, the assembler puts a WAIT instruction before the wait versions and a NOP 
instruction before the no-wait versions. 


FPREM Partial Remainder 163 


FNOP No Operation 


Performs no operation. FNOP can be used for timing delays or alignment. 


Syntax Examples CPU — Clock Cycles 
FNOP fnop | 87 10-16 

287 10-16 

387 12 

486 3 


FPATAN Partial Arctangent 


Finds the partial tangent by calculating Z = ARCTAN(Y / X). X is taken from ST 
and Y from ST(1). On the 8087/287, Y and X must be in the range OS Y<X<co, 
On the 80387-80486, there is no restriction on X and Y. X is popped from the 
stack and Z replaces Y in ST. 


Syntax Examples CPU = _ Clock Cycles 


FPATAN fpatan 87 250-800 
287 250-800 
387 314-487 
486 218-303 


FPREM Partial Remainder 


Calculates the remainder of ST divided by ST(1), returning the result in ST. The 
remainder retains the same sign as the original dividend. The calculation uses the 
following formula: 


remainder = ST - ST(1) * quotient 


The quotient is the exact value obtained by chopping ST / ST(1) toward 0. The 
instruction is normally used in a loop that repeats until the reduction is complete, as 
indicated by the condition codes of the status word. 


164 


FPREM1 


Partial Remainder (IEEE Compatible) 


Syntax Examples CPU = Clock Cycles 
FPREM fprem . 87 15-190 

287 15-190 

387 74-155 

486 70-138 


Condition Codes for FPREM and FPREM1 


C3 C2 C1 CO Meaning 

? 1 ? ? Incomplete reduction 
0 0 0 0 quotient MOD 8 = 0 
0 0 0 1 quotient MOD 8 = 4 
0 0 1 0 quotient MOD 8 = 1 
0 0 1 1 quotient MOD 8 = 5 
1 0 0 0 quotient MOD 8 = 2 
1 0 0 1 quotient MOD 8 = 6 
1 0 1 0 quotient MOD 8 = 3 
1 0 i 1 quotient MOD 8 =7 


FPREM1 Partial Remainder (IEEE Compatible) 


80387-80486 Only Calculates the remainder of ST divided by ST(1), returning the 
result in ST. The remainder retains the same sign as the original dividend. The 
calculation uses the following formula: 


remainder = ST - ST(1) *« quotient 


The quotient is the integer nearest to the exact value of ST / ST(1). When two 
integers are equally close to the given value, the even integer is used. The 
instruction is normally used in a loop that repeats until the reduction is complete, as 
indicated by the condition codes of the status word. See FPREM for the possible 
condition codes. 


Syntax Examples CPU = Clock Cycles 
FPREM1 fpreml 87 — 

287 — 

387 95-185 


486 72-167 © 


FRNDINT Roundtolnteger 165 


FPTAN Partial Tangent 


FRNDINT 


Finds the partial tangent by calculating Y / X = TAN(Z). Z is taken from ST. Z 
must be in the range 0 < Z < 1/4 on the 8087/287. On the 80387-80486, |Z] must 
be less than 263, The result is the ratio Y / X. Y replaces Z, and X is pushed into 
ST. Thus, Y is returned in ST(1) and X in ST. 


Syntax Examples CPU Clock Cycles 
FPTAN fptan 87 30-540 
287 30-540 


387 191-497* 
486 200-2737 


* For operands with an absolute value greater than 1/4, up to 76 additional clocks may be required. 


+ For operands with an absolute value greater than 7/4, add n clocks where n = operand/(n/4). 


Round to Integer 


Rounds ST from a real number to an integer. The rounding control (RC) field of the 
control word specifies the rounding method, as shown in the introduction to this 
section. | 


Syntax Examples CPU Clock Cycles 
FRNDINT frndint 87 16-50 

287 16-50 

387 66-80 


486 21-30 . 


166 FRSTOR/FRSTORW/FRSTORD Restore Saved State 


FRSTOR/FRSTORW/FRSTORD Restore Saved State 


Restores the 94-byte coprocessor state to the coprocessor from the specified 
memory location. In 32-bit mode on the 80387-80486, the environment state takes 


108 bytes. 

Syntax Examples CPU Clock Cycles 
FRSTOR mem frstor [bp-94] 87 (197—207)+EA 
FRSTORW mem* 287 + 

FRSTORD mem* 387 308 


486 131,pm=120 
* 80387-80486 only. 


+ Clock counts are not meaningful in determining overall execution time of this instruction. Timing is 
determined by operand transfers. 


FSAVE/FSAVEW/FSAVED/FNSAVE/ 
FNSAVEW/FNSAVED Save Coprocessor State 


Stores the 94-byte coprocessor state to the specified memory location. In 32-bit 
mode on the 80387-80486, the environment state takes 108 bytes. This instruction 
has wait and no-wait versions. After the save, the coprocessor is initialized as if 


FINIT had been executed. 

Syntax Examples CPU = Clock Cycles§ 
FSAVE mem fsave [bp-94] 87 (197-207)+EA 
FSAVEW mem* fsave cobuffer 287 t 

FSAVED mem* 387 375-376 
FNSAVE mem 486 154,pm=143 
FNSAVEW mem* 

FNSAVED mem* 


* 80387-80486 only. 


+ Clock counts are not meaningful in determining overall execution time of this instruction. Timing is 
determined by operand transfers. 


§ These timings reflect the no-wait version of the instruction. The wait version may take additional 
clock cycles. 


FSETPM SetProtectedMode 167 


FSCALE Scale 


Scales by powers of 2 by calculating the function Y = Y * 2%. X is the scaling 
factor taken from ST(1), and Y is the value to be scaled from ST. The scaled result 
replaces the value in ST. The scaling factor remains in ST(1). If the scaling factor is 
not an integer, it will be truncated toward zero before the scaling. 


On the 8087/287, if X is not in the range -2!5 < X < 215 or if X is in the range 0 < 
X < 1, the result will be undefined. The 80387-80486 have no restrictions on the 
range of operands. 


Syntax Examples CPU Clock Cycles 
FSCALE fscale 87 32-38 

287 32-38 

387 67-86 

486 30-32 


FSETPM Set Protected Mode 


80287 Only Sets the 80287 to protected mode. The instruction and operand 
pointers are in the protected-mode format after this instruction. On the 
80387-80486, FSETPM is recognized but interpreted as FNOP, since the 
80386/486 processors handle addressing identically in real and protected mode. 


Syntax Examples CPU = Clock Cycles 
FSETPM fsetpm 87 — 

287 2-8 

387 12 


486 3 


168 FSIN Sine 


FSIN Sine 


80387-80486 Only Replaces a value in radians in ST with its sine. If |ST| < 2%, 
the C2 bit of the status word is cleared and the sine is calculated. Otherwise, C2 is 
set and no calculation is performed. ST can be reduced to the required range with 


FPREM or FPREM1. 
Syntax Examples CPU = Clock Cycles 
FSIN fsin 87 — 


287 — 
387 122-771* 
486 257-3544 


* For operands with an absolute value greater than 7/4, up to 76 additional clocks may be required. 


+ For operands with an absolute value greater than 1/4, add n clocks where n = operand/(n/4). 


FSINCOS Sine and Cosine 


80387-80486 Only Computes the sine and cosine of a radian value in ST. The sine 
replaces the value in ST, and then the cosine is pushed onto the stack. If |ST| < 2°, 
the C2 bit of the status word is cleared and the sine and cosine are calculated. 
Otherwise, C2 is set and no calculation is performed. ST can be reduced to the 
required range with FPREM or FPREM1. 


Syntax Examples CPU = _ Clock Cycles 
FSINCOS fsincos 87 — 
287 —— 


387 194-809* 
486 292-365} 


* For operands with an absolute value greater than 7/4, up to 76 additional clocks may be required. 


+ For operands with an absolute value greater than 77/4, add n clocks where n = operand/(n/4). 


FSQRT Square Root 


FST/FSTP/FIST/FISTP/FBSTP Store 169 


Replaces the value of ST with its square root. (The square root of —0 is —0.) 


Syntax 
FSQRT 


Examples 


fsqrt 


CPU 


87 

287 
387 
486 


FST/FSTP/FIST/FISTP/FBSTP Store 


Clock Cycles 


180-186 
180-186 
122-129 
83-87 


Stores the value in ST to the specified memory location or register. ‘Temporary-real 
values in registers are converted to the appropriate integer, BCD, or floating-point 
format as they are stored. With FSTP, FISTP, and FBSTP, the ST register value is 
popped off the stack. Memory operands can be 32-, 64-, or 80-bit real numbers for 
FSTP or 16-, 32-, or 64-bit integers for FISTP. 


Syntax 
FST reg 


FSTP reg 


FST memreal 


FSTP memreal 


Examples 


fst st(6) 
fst st 


fstp st 
fstp st(3) 


fst shortreal 
fst longs[bx] 


fstp 
fstp 


longreal 
tempreals[bx] 


CPU 


87 

287 
387 
486 


87 

287 
387 
486 


87 


287 
387 
486 


87 


287 


387 
486 


Clock Cycles 


(s=84—90,/=96-104)+ 
EA 
s=84—90,/=96-104 
s=44,/=45 

s=7,1=8 


(s=86—92,/=98-106, 
t=52-58)+EA 
s=86-92,/=98-106, 
t=52-58 

s=44 1=45,t=53 
s=7,1=8 ,t=6 


170 FSTCW/FNSTCW Store Control Word 


Syntax 
FIST memint 


FISTP memint 


FBSTP membcd 


FSTCW/FNSTCW Store Control Word 


Examples 


fist intl6 
fist doubles[8] 


fistp longint 
fistp doubles[bx] 


fbstp bcds[bx] 


CPU 
87 


287 
387 
486 


87 


287 


387 


486 


87 

287 
387 
486 


Clock Cycles 


(w=80-90,d=82-92)+ 
EA 
w=80-90,d=82-92 
w=82-95,d=79-93 
w=29-34,d=28-34 


(w=82-92 d=84—-94, 
q=94-105)+EA 
w=82—92,d=84-94, 
q=94-105 
w=82-95 d=79-93, 
q=80-97 

29-34 
(520-540)+EA 
520-540 

512-534 

172-176 


Stores the control word to a specified 16-bit memory operand. This instruction has 
wait and no-wait versions. 


Syntax 


FSTCW meml6 
FNSTCW meml6 


Examples 


fstcw ctriword 


CPU 


87 

287 
387 
486 


Clock Cycles* 


12-18 
12-18 
15 

3 


* These timings reflect the no-wait version of the instruction. The wait version may take additional 


clock cycles. 


FSTENV/FSTENVW/FSTENVD/FNSTENV/FNSTENVW/ 


FNSTENVD Store Environment State 


Stores the 14-byte coprocessor environment state to a specified memory location. 
The environment state includes the control word, status word, tag word, instruction 
pointer, and operand pointer. On the 80387-80486 in 32-bit mode, the environment 


‘state is 28 bytes. 


FSUB/FSUBP/FISUB Subtract 


Syntax Examples CPU 
FSTENV mem fstenv [bp-14] 87 
FSTENVW mem* 287 
FSTENVD mem* 387 
FNSTENV mem 486 
FNSTENVW mem* 

FNSTENVD mem* 


* 80387-80486 only. 


Clock Cycles+ 


(40-50)+EA 
40-50 
103-104 
67,pm=56 


+ These timings reflect the no-wait version of the instruction. The wait version may take additional 


clock cycles. 


FSTSW/FNSTSW Store Status Word 


171 


Stores the status word to a specified 16-bit memory operand. On the 80287, 80387, 
and 80486, the status word can also be stored to the processor’s AX register. This 


instruction has wait and no-wait versions. 


Syntax Examples CPU 
FSTSW meml6 fstsw statword 87 
FNSTSW meml6 287 
387 
486 
FSTSW AX fstsw ax 87 
FNSTSW AX 287 
387 
486 


Clock Cycles* 


* These timings reflect the no-wait version of the instruction. The wait version may take additional 


clock cycles. 


FSUB/FSUBP/FISUB Subtract 


Subtracts the source operand from the destination operand and returns the 
difference in the destination operand. If two register operands are specified, one 


must be ST. If a memory operand is specified, the result replaces the value in ST. 


Memory operands can be 32- or 64-bit real numbers or 16- or 32-bit integers. If no 

operand is specified, ST is subtracted from ST(1) and the stack is popped, returning 
the difference in ST. For FSUBP, the source must be ST; the difference (destination 
minus source) is returned in the destination register and ST is popped. | 


172 


FSUBR/FSUBRP/FISUBR Subtract Reversed . 


Syntax 
FSUB [reg,reg] 


FSUBP reg,ST 


FSUB memreal 


FISUB memint 


Examples 


fsub st,st(2) 
fsub st(5),st 
fsub 


fsubp st(6),st 


fsub longreal 
fsub shortreals[di] 


fisub double 
fisub warray[di] 


CPU 


87 

287 
387 
486 


87 

287 
387 
486 


87 


287 
387 
486 


87 


287 


387 
486 


Clock Cycles 


70-100 

70-100 

to=29-37, fr=26-34 
8-20 


75-105 
75-105 
26-34 
8-20 


(s=90-120,s=95-125) 
+EA 
s=90—120,/=95-125 
s=24—32,1=28-36 
8-20 


(w=102-137,d=108- 
143)+EA 
w=102-137,d=108- 
143 : 


w=71-83 d=57-82 


w=20-35,d=19-32 


FSUBR/FSUBRP/FISUBR Subtract Reversed 


Subtracts the destination operand from the source operand and returns the result in 
the destination operand. If two register operands are specified, one must be ST. Ifa 
memory operand is specified, the result replaces the value in ST. Memory operands 
can be 32- or 64-bit real numbers or 16- or 32-bit integers. If no operand is 
specified, ST(1) is subtracted from ST and the stack is popped, returning the 
difference in ST. For FSUBRP, the source must be ST; the difference (source 
minus destination) is returned in the destination register and ST is popped. 


Syntax 
FSUBR [reg,reg] 


FSUBRP reg,ST 


Examples 


fsubr st,st(2) 
fsubr st(5),st 
fsubr 


fsubrp st(6),st 


CPU 


87 

287 
387 
486 


87 

287 
387 
486 


Clock Cycles 


70-100 

70-100 

to=29-37, fr=26-34 
8-20 


75-105 
75-105 
26-34 
8-20 


FUCOM/FUCOMP/FUCOMPP Unordered Compare 173 


Syntax Examples CPU 
FSUBR memreal fsubr QWORD PTR [bx] 87 
fsubr shortreal[di] 
fsubr  longreal . 287 
387 
486 
FISUBR memint fisubr intl6 87 
fisubr warray[di] 
fisubr double 287 
387 
486 


FIST Test for Zero 


Clock Cycles 


(s=90-120,s=95-125) 
+FA 
s=90—120,/=95-125 
s=25—33,/=29-37 
8-20 


(w=103-139,d=109- 
144)+EA 
w=103-139,d=109- 
144 

w=72-84 ,d=58-83 
w=20-55,d=19-32 


Compares ST with +0.0 and sets the condition of the status word according to the 


result. 

Syntax Examples CPU 

FTST ftst 87 
287 
387 
486 


Condition Codes for FTST 

C3 C2 Cl CO Meaning 

ST is positive 
ST is negative 
ST is 0 


_- —- © © 
eS Oyo. 
- CO - © 


Clock Cycles 


ST is not comparable (NAN or projective infinity) 


FUCOM/FUCOMP/FUCOMPP § Unordered Compare 


80387-80486 Only Compares the specified source to ST and sets the condition 
codes of the status word according to the result. The instruction subtracts the source 
operand from ST without changing either operand. Memory operands are not 
allowed. If no operand is specified or if two pops are specified, ST is compared to 
ST(1). If one pop is specified with an operand, the given register is compared to ST. 


174 


FWAIT Wait 


Unlike FCOM, FUCOM does not cause an invalid-operation exception if one of 


the operands is NAN. Instead, the condition codes are set to unordered. 


Syntax 


FUCOM [reg] 


FUCOMP [reg] 


FUCOMPP 


Examples 


fucom st(2) 


fucom 


fucomp st(7) 


fucomp 


fucompp 


Condition Codes for FUCOM 


C3 


—_- =-=- © © 


FWAIT Wait 


Suspends execution of the processor until the coprocessor is finished executing. 
This is an alternate mnemonic for the processor WAIT instruction. 


Syntax 
FWAIT 


C2 


- OF OC O&O 


Cl CO 


yy ON NYY 
re Oo —- © 


Examples 


fwait 


CPU Clock Cycles 

87 — 

287 — 

387 24 

486 4 

87 — 

287 — 

387 26 

486 4 

87 — 

287 — 

387 26 

486 5 
Meaning 
ST > source 
ST < source 
ST = source 
Unordered 


CPU —_ Clock Cycles 
87 4 

287 3 

387 6 

486 1-3 
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FXAM Examine 


Reports the contents of ST in the condition flags of the status word. 


Syntax Examples CPU Clock Cycles 
FXAM fxam 87 12-23 

287 12-23 

387 30-38 

486 8 


Condition Codes for FXAM 


C3 C2 Cl CO Meaning 

0 0 0 0 + Unnormal* 
0 0 0 1 + NAN 

0 0 1 0 — Unnormal* 
0 0 1 1 —NAN 

0 1 0 0 + Normal 

0 1 0 1 + Infinity 

0 1 1 0 — Normal 

0 1 1 1 — Infinity 

1 0 0 0 +0 

1 0 0 1 Empty 

1 0 1 0 -—0 

1 0 1 l Empty 

1 1 0 0 + Denormal 
1 1 0 1 Empty* 

1 1 1 0 — Denormal 
1 1 1 l Empty* 


* Not used on the 80387-80486. Unnormals are not supported by the 80387-80486. Also, the 
80387-80486 use two codes instead of four to identify empty registers. 
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FXCH Exchange Registers 


Exchanges the specified (destination) register and ST. If no operand is specified, ST 


and ST(1) are exchanged. 
Syntax Examples CPU Clock Cycles 
FXCH [reg] fxch_ st(3) 87 10-15 
fxch 287 10-15 
387 18 
486 4 


FXTRACT Extract Exponent and Significand 


Extracts the exponent and significand (mantissa) fields of ST. The exponent 
replaces the value in ST, and then the significand is pushed onto the stack. 


Syntax Examples CPU = Clock Cycles 


FXTRACT fxtract 87 27-55 
287, 27-55 
387 70-76 
486 16-20 


FYL2X Y log,(X) 


Calculates Z = Y log(X). X is taken from ST and Y from ST(1). The stack is 
popped, and the result, Z, replaces Y in ST. X must be in the range 0 < X < oo and 
Y in the range —co < Y < ©, 


Syntax Examples CPU Clock Cycles 


FYL2xX fy12x 87 900-1100 
287 900-1100 
387 120-538 
486 196-329 


FYL2XP1 
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Y log,(X+1) 


Calculates Z = Y logo(X + 1). X is taken from ST and Y from ST(1). The stack is 
popped once, and the result, Z, replaces Y in ST. X must be in the range 0 < |X| < 
(1 — (V2 /2)). Y must be in the range —co < Y < co, 


Syntax Examples CPU Clock Cycles 


FYL2XP1 fy12xpl 87 700-1000 
287 700-1000 
387 257-547 
486 171-326 
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~ Introduction 


Each of the INCLUDE files is listed with the names of the macros it contains. 
Macros listed take the form: 


<macroname>MACRO[EL <variables[[:=<default value>]], ..>]] 


Some variables are listed as name-:regq. In these cases, req indicates that 
macroname cannot be called without the variable name supplied. 


For specific information on the macros themselves, see the contents of the 
commented *.INC file. 


BIOS.INC 


@Cls MACRO pagenum 

@GetCharAtr MACRO pagenum 

@GetCsr MACRO pagenum 

@GetMode MACRO 

@PutChar MACRO chr, atrib, pagenum, loops 
@PutCharAtr MACRO chr, atrib, pagenum, loops 
@Scroll MACRO distance:REQ, atrib:=<07h>, upcol, uprow, dncol, dnrow 
@SetColor MACRO color 

@SetCsrPos MACRO column, row, pagenum 
@SetCsrSize MACRO first, last 

@SetMode MACRO mode 

@SetPage MACRO pagenum 

@SetPalette MACRO color 


CMACROS.INC, CMACROS.NEW 


These two include files contain the same macros. Use CMACROS.NEW for 
programs written in MASM 6.0 and later. Use CMACROS.INC for programs 
written in MASM 5.1 or earlier, or if you have problems with CMACROS.NEW. 


@reverse MACRO list 
arg MACRO args 
assumes MACRO ss,In 
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callcrt MACRO funcname 

cBegin MACRO pname 

cEnd MACRO pname 

cEpilog MACRO procname, flags, cbParms, cbLocals, reglist, userparms 
cProc MACRO pname:REQ, attribs, autoSave 

cPrologue MACRO procname, flags, cbParms, cbLocals, reglist, userparms 
createSeg MACRO segName, logName, aalign, combine, class, grp 
cRet MACRO 

defGrp MACRO foo:vararg 

erm$ MACRO 1x 

ermz MACRO x 

extenA MACRO names:req, langtype 

externB MACRO names:req; langtype 

externCP MACRO n,c 

extenD MACRO names:req, langtype 

extemDP MACRO n,c 

externFP MACRO names:req, langtype 

externNP MACRO names:req, langtype 

externP MACRO n,c 

externQ MACRO names:req, langtype 

externT MACRO names:req, langtype 

externW MACRO names:req, langtype 

farPtr MACRO n,s,o 

globalB MACRO name:req, init Val:=<?>, repCount, langType 
globalCP MACRO n,ji,s,c 

globalD MACRO name:req, initVal:=<?>, repCount, langType 
globalDP MACRO n,ji,s,c . 

globalQ MACRO name:req, initVal:=<?>, repCount, langType 
globalT MACRO name:req, init Val:=<?>, repCount, langType 
globalW MACRO name:req, init Val:=<?>, repCount, langType 
labelB MACRO names:req,langType 

labelCP MACRO n,c 
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labeID MACRO names:req,langType 
labeIDP MACRO n,c 

labelFP MACRO names:req,langType 
labeINP MACRO names:req,langType 
labelP MACRO n,c 

labelQ MACRO names:req,langType 
labeIlT MACRO names:req,langType 
labelW MACRO names:req,langType 
Ib1 MACRO names:req 

localB MACRO name 

localCP MACRO n 

localD MACRO name 

localDP MACRO n 

localQ MACRO name 

localT MACRO name 

localV MACRO name,a 

localW MACRO name 
logName&_assumes MACRO s 
logName&_sbegin MACRO 

n MACRO 

outif MACRO name:req, defval:=<0>, onmsg, offmsg 
parmB MACRO names:req 

parmCP MACRO n 

parmD MACRO names:req 

parmDP MACRO n 

parmQ MACRO names:req 

parmR MACRO n,r,r2 

parmT MACRO names:req 

parmW MACRO names:req 

regPtr MACRO n,s,o 

save MACRO r 

sBegin MACRO name:req 
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sEnd MACRO name 

setDefLangType MACRO overLangType 

staticB MACRO name:req, initVal:=<?>, repCount 

staticCP MACRO name:req, i, s 

staticD MACRO name:regq, initVal:=<?>, repCount 

staticDP MACRO name:req, i, s 

staticl MACRO name:req, initVal:=<?>, repCount 

staticQ MACRO name:req, initVal:=<?>, repCount 

staticT MACRO name:req, initVal:=<?>, repCount ; \ 
staticW MACRO name:req, initVal:=<?>, repCount 


MS-DOS.INC 


NPVOID TYPEDEF NEAR PTR 

FPVOID TYPEDEF FAR PTR 

FILE_INFO STRUCT 

@ChDir MACRO path:REQ, segmnt 
@ChkDrv MACRO drive 

@CloseFile MACRO handle:REQ 

@DelFile MACRO path:REQ, segmnt 

@Exit MACRO return 

@FreeBlock MACRO segmnt 

@GetBlock MACRO graphs:REQ, retry:=<0> 
@GetChar MACRO ech:=<1>, cc:=<1>, clear:=<0> 
@GetDate MACRO 

@GetDir MACRO buffer:REQ, drive, segmnt 
@GetDrv MACRO 

@GetDTA MACRO 

@GetFileSize MACRO handle:REQ 
@GetFirst MACRO path:REQ, atrib, segmnt 
@GetInt MACRO interrupt:REQ 

@GetNext MACRO 
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@GetStr MACRO ofset:REQ, terminator, limit, segmnt 
@GetTime MACRO 

@GetVer MACRO . 

@MakeFile MACRO path:REQ, atrib:=<0>, segmnt, kind 
@MkDir MACRO path:REQ, segmnt 

@ModBlock MACRO graphs:REQ, segmnt 

@MoveFile MACRO old:REQ, new:REQ, segold, segnew 
@MovePtrAbs MACRO handle:REQ, distance 
@MovePtrRel MACRO handle:REQ, distance 
@OpenFile MACRO path:REQ, access:=<0>, segmnt 
@PrtChar MACRO chr: VARARG 

@Read MACRO ofset:REQ, bytes:REQ, handle:=<0>, segmnt 
@RmDir MACRO path:REQ, segmnt 


-@SetDate MACRO month:REQ, day:REQ, year:REQ 


@SetDrv MACRO drive:REQ 

@SetDTA MACRO buffer:REQ, segmnt 

@SetInt MACRO interrupt:REQ, vector:REQ, segmnt 

@SetTime MACRO hour:REQ, minutes:REQ, seconds:REQ, hundredths:REQ 
@ShowChar MACRO chr: VARARG 

@ShowStr MACRO ofset:REQ, segmnt 

@TSR MACRO paragraphs:REQ, return 

@Write MACRO ofset:REQ, bytes:REQ, handle:=<1>, segmnt 


MACROS.INC 


@ ArgCount MACRO arglist: VARARG 

@ Argl MACRO index:REQ, arglist!: VARARG 
@ArgRev MACRO arglist 

@PopAll MACRO 

@PushAll MACRO 

@RestoreRegs MACRO |. 

@SaveRegs MACRO regs: VARARG 

echof MACRO format:REQ, args: VARARG 
pushc MACRO op 
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PROLOGUE.INC | 


WIN.INC 


cEpilogue MACRO szProcName, flags, cbParams, cbLocals, rgRegs, 
rgUserParams 


cPrologue MACRO szProcName, flags, cbParams, cbLocals, rgRegs, 
rgUserParams 


The include file WIN.INC is WINDOWS.H processed by H2INC, and slightly 
modified to reduce unnecessary warnings. 
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Tables 


ASCII Chart 
Key Codes 


Ce 


MS-DOS Program Segment Prefix (PSP) 
Color Display Attributes 
Hexadecimal-Binary-Decimal Conversion 


Ce er} 
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ASCII Codes 


Ctrl Dec Hex Char Code Dec Hex Char Dec Hex Char Dec Hex Char 
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¢ ASCII code 127 has the code DEL. Under MS-DOS, this code has the same effect as ASCII 8 (BS). 
The DEL code can be generated by the CTRL+BKSP key. 


Tables 189 


Dec Hex Char Dec Hex Char Dec Hex Cha Dec Hex Char 


22> Ds Su 
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a 
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Key Codes 


Q 
Ww 
E 
R 
T 
Y 
U 
I 
O 
P 


ASCII or 
Extendede 


03 NUL 


1LOWDNKHDUPWNHE 


AA-ontOrFPEeEK THO EQ 


AAwK~AWVOHGHHADHMZO 


> CASTANOS YMSA ies) 
Q Z 
4 = 
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th 
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oa BH wu. b'Q hon 
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-S Bp odaKN]| 
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VA 
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ASCII or 
Scan ASCII or Extended 
Code Extendede with CTRL 


53 34 NUL§ 
164 AS NUL 


¢ Extended codes return 0 (NUL) or EO (decimal 224) as the initial character. This is a signal that a second 
(extended) code is available in the keystroke buffer. 

§ These key combinations are only recognized on extended keyboards. 

£ These keys are only available on extended keyboards. Most are in the Cursor/Control cluster. If the raw 
scan code is read from the keyboard port (60h), it appears as two bytes (E0h) followed by the normal scan 
code. However, when the keypad ENTER and / keys are read through the BIOS interrupt 16h, only EOh is 
seen since the interrupt only gives one-byte scan codes. 

e+ Under MS-DOS, SHIFT + PRTSC causes interrupt 5, which prints the screen unless an interrupt handler has 
been defined to replace the default interrupt 5 handler. 
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MS-DOS Program Segment Prefix (PSP) 


0-12 3 4 5 6 7 8 9 AB CGC D CE F 


1 Opcode for INT 20h instruction (CDh 20h) 

2 Segment of first allocatable address following the program (used for memory allocation) 
3 Reserved or used by MS-DOS . 

4 Opcode for far call to MS-DOS function dispatcher 

5 Vector for terminate routine 

6 Vector for CTRL+C handler routine 

7 Vector for error handler routine 

8 Segment address of program’s environment block 


9 Opcode for MS-DOS INT 21h and far return (you can do a far call to this address to execute 
MS-DOS calls) 


10 First command-line argument (formatted as uppercase 11-character filename) 

11 Second command-line argument (formatted as uppercase 11-character filename) 
12 Number of bytes in command-line argument 

13 Unformatted command line and/or default Disk Transfer Area (DTA) 


Color Display Attributes 


Background 
Bits 

F R 
0 0 
0 0 
0 0 
0 0 
0 1 
0 1 
0 1 
0 iM 
1 0 
1 0 
1 0 
I 0 
1 I 
l I 
1 1 
1 1 


F Flashing bit 
R Red bit 


=| =p OC Or,rrRoda°orereooaoreroo 


<p) 


Num 

B 
0 0 
1 1 
0 2 
1 3 
0 4 
1 5 
0 6 
1 7 
0 8 
It 9 
0 A 
l B 
0 C 
1 D 
0 E 
I F 
G Green bit 
B_ Blue bit 


Foreground 


Color Bits* 


I 


Black 
Blue 
Green 
Cyan 
Red 
Magenta 


White 

Black blink 
Blue blink 
Green blink 
Cyan blink 
Red blink 
Magenta blink 
Brown blink 


0 
0 
0 
0 
0 
0 
Brown 0 
0 
1 
1 
1 
I 
1 
1 
1 
White blink 1 


I Intensity bit 


R 


Lee cee ec SO > = > Gl >) 


Q 


-e Cor SF OOo He Se OOO Ke Se OLS 


= OO —_— © — CO = CO -— 2 = CO = CO = © 


Num 
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Color 


Black 

Blue 

Green 

Cyan 

Red 
Magenta 
Brown 
White 

Dark gray 
Light Blue 
Light green 
Light cyan 
Light red 
Light Magenta 
Yellow 
Bright White 


* On monochrome monitors, the blue bit is set and the red and green bits are cleared (001) for underline; all color bits are set (111) 


for normal text. 
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Hexadecimal-Binary-Decimal Conversion 


Hex Binary Decimal Digit Decimal Digit Decimal Digit Decimal Digit 
Number Number 000X 00X0 0X00 X000 
0 0000 0 0 0 0 

1 0001 1 16 256 4,096 
wp) 0010 2 32 512 8,192 
3 0011 3 48 768 12,288 
4 0100 4 64 1,024 16,384 
5 0101 5 80 1,280 20,480 
6 0110 6 96 1,536 24,576 
‘4 0111 7 112 1,792 28,672 
8 1000 8 128 2,048 32,768 
9 1001 9 144 2,304 36,864 
A 1010 10 160 2,560 40,960 
B 1011 11 176 2,816 45,056 
C 1100 12 192 3,072 49,152 
D 1101 13 208 3,328 53,248 
E 1110 14 224 3,584 57,344 
F 1111 15 240 3,840 61,440 


Microsoft Corporation 
One Microsoft Way 
Redmond, WA 98052-6399 
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